Webhooks

{
  "id": "evt_01J9X1A2B3C4D5E6F7G8H9J0",
  "event": "deposit.detected",
  "created_at": "2026-08-20T21:15:30.120Z",
  "data": {
    "deposit_id": "dep_01J9X1A2B3C4D5E6F7G8H9J0",
    "merchant_id": "mrc_01HZX89ABCDEF1234567890",
    "end_user_id": "usr_internal_9381",
    "network": "POLYGON",
    "asset": "USDT",
    "amount": "250.000000",
    "tx_hash": "0x4f8a9b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a",
    "deposit_address": "0x742d35Cc6634C0532925a3b844Bc454e4438f44e",
    "confirmations": 2,
    "required_confirmations": 12,
    "detected_at": "2026-08-20T21:15:30.000Z"
  }
}

import express, { Request, Response } from "express";
import crypto from "crypto";

const app = express();
const WEBHOOK_SECRET = process.env.VAULTCORE_WEBHOOK_SECRET || "whsec_...";

// IMPORTANTE: capturar el raw body como Buffer para verificar la firma
app.post(
  "/webhooks/vaultcore",
  express.raw({ type: "application/json" }),
  (req: Request, res: Response) => {
    const signatureHeader = req.headers["x-vaultcore-signature"] as string;
    const eventType = req.headers["x-vaultcore-event"] as string;
    const deliveryId = req.headers["x-vaultcore-delivery-id"] as string;

    if (!signatureHeader) {
      return res.status(401).json({ error: "Missing X-Vaultcore-Signature header" });
    }

    const rawBody = req.body; // Buffer en crudo

    const computedSignature = crypto
      .createHmac("sha256", WEBHOOK_SECRET)
      .update(rawBody)
      .digest("hex");

    const signatureBuffer = Buffer.from(signatureHeader, "utf8");
    const computedBuffer = Buffer.from(computedSignature, "utf8");

    if (
      signatureBuffer.length !== computedBuffer.length ||
      !crypto.timingSafeEqual(signatureBuffer, computedBuffer)
    ) {
      return res.status(401).json({ error: "Invalid webhook signature" });
    }

    const payload = JSON.parse(rawBody.toString("utf8"));
    console.log(`Webhook verificado [${eventType}] - Delivery ID: ${deliveryId}`);

    switch (eventType) {
      case "deposit.confirmed":
        // Acredita saldo de forma idempotente usando payload.data.deposit_id
        break;
      case "transfer.confirmed":
        // Marca el retiro como completado con payload.data.tx_hash
        break;
      default:
        break;
    }

    return res.status(200).json({ received: true });
  },
);

app.listen(3000);