Webhooks

const express = require("express");
const crypto = require("crypto");
const app = express();

app.use(express.json());

app.post("/webhooks/zochil", (req, res) => {
  const signature = req.get("X-Zochil-Signature");
  const payload = JSON.stringify(req.body);

  // Verify webhook signature (recommended)
  if (!verifySignature(payload, signature)) {
    return res.status(401).send("Unauthorized");
  }

  const { event, data } = req.body;

  // Handle the event
  switch (event) {
    case "user.created":
      console.log("New user:", data.user);
      // Send welcome email, create user profile, etc.
      break;

    case "order.created":
      console.log("New order:", data.order);
      // Update inventory, send confirmation, etc.
      break;

    default:
      console.log("Unhandled event:", event);
  }

  res.status(200).send("OK");
});

function verifySignature(payload, signature) {
  const webhookSecret = process.env.ZOCHIL_WEBHOOK_SECRET;
  const expectedSignature = crypto
    .createHmac("sha256", webhookSecret)
    .update(payload)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(`sha256=${expectedSignature}`)
  );
}

app.listen(3000);

from flask import Flask, request, jsonify
import hashlib
import hmac
import json
import os

app = Flask(__name__)

@app.route('/webhooks/zochil', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Zochil-Signature')
    payload = request.get_data(as_text=True)

    # Verify webhook signature
    if not verify_signature(payload, signature):
        return jsonify({'error': 'Unauthorized'}), 401

    data = request.json
    event = data.get('event')
    event_data = data.get('data')

    # Handle the event
    if event == 'user.created':
        print(f"New user: {event_data['user']}")
        # Handle user creation

    elif event == 'order.created':
        print(f"New order: {event_data['order']}")
        # Handle order creation

    else:
        print(f"Unhandled event: {event}")

    return jsonify({'status': 'success'}), 200

def verify_signature(payload, signature):
    webhook_secret = os.environ.get('ZOCHIL_WEBHOOK_SECRET')
    expected_signature = hmac.new(
        webhook_secret.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(
        signature,
        f"sha256={expected_signature}"
    )

if __name__ == '__main__':
    app.run(debug=True)

curl -X POST "https://api.zochil.io/admin/webhooks" \
  -H "access-token: YOUR_ACCESS_TOKEN" \
  -H "device-id: YOUR_DEVICE_ID" \
  -H "merchant-id: YOUR_MERCHANT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com/webhooks/zochil",
    "events": ["user.created", "order.created", "order.updated"],
    "active": true,
    "secret": "your-webhook-secret-key"
  }'

const response = await fetch("https://api.zochil.io/admin/webhooks", {
  method: "POST",
  headers: {
    "access-token": "YOUR_ACCESS_TOKEN",
    "device-id": "YOUR_DEVICE_ID",
    "merchant-id": "YOUR_MERCHANT_ID",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    url: "https://your-app.com/webhooks/zochil",
    events: ["user.created", "order.created", "order.updated"],
    active: true,
    secret: "your-webhook-secret-key"
  })
});

const webhook = await response.json();
console.log("Webhook created:", webhook.data.id);

const express = require("express");
const app = express();

app.use(express.json());

app.post("/test-webhook", (req, res) => {
  console.log("Received webhook:");
  console.log("Headers:", req.headers);
  console.log("Body:", JSON.stringify(req.body, null, 2));

  res.status(200).send("Webhook received");
});

app.listen(3000, () => {
  console.log("Webhook tester running on port 3000");
});