Webhooks

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  if (!signature) return false;

  // Extraer timestamp y firma
  const parts = signature.split(',');
  const timestampPart = parts.find(p => p.startsWith('t='));
  const signaturePart = parts.find(p => p.startsWith('v1='));

  if (!timestampPart || !signaturePart) return false;

  const timestamp = parseInt(timestampPart.replace('t=', ''), 10);
  const receivedSignature = signaturePart.replace('v1=', '');

  // Verificar que no sea muy antiguo (5 minutos)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - timestamp) > 300) {
    console.error('Webhook timestamp demasiado antiguo');
    return false;
  }

  // Calcular firma esperada
  const signedPayload = `${timestamp}.${payload}`;
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  // Comparación timing-safe
  try {
    return crypto.timingSafeEqual(
      Buffer.from(receivedSignature),
      Buffer.from(expectedSignature)
    );
  } catch {
    return false;
  }
}

const express = require('express');
const router = express.Router();

router.post('/cobrix', 
  express.raw({ type: 'application/json' }), 
  async (req, res) => {
    const signature = req.headers['x-cobrix-signature'];
    const rawBody = req.body.toString();

    // 1. Verificar firma
    if (!verifyWebhookSignature(rawBody, signature, process.env.COBRIX_WEBHOOK_SECRET)) {
      console.error('Firma inválida');
      return res.status(401).json({ error: 'Invalid signature' });
    }

    const event = JSON.parse(rawBody);
    console.log(`Webhook: ${event.event} (${event.id})`);

    // 2. Responder inmediatamente
    res.status(200).json({ received: true });

    // 3. Procesar en background
    setImmediate(async () => {
      try {
        switch (event.event) {
          case 'payment.succeeded':
            await handlePaymentSucceeded(event.data);
            break;
          case 'payment.failed':
            await handlePaymentFailed(event.data);
            break;
        }
      } catch (error) {
        console.error('Error procesando webhook:', error);
      }
    });
  }
);

async function handlePaymentSucceeded(data) {
  const { payment, metadata } = data;
  console.log(`✅ Pago exitoso: ${payment.transactionId}`);
  
  // Actualizar orden en tu base de datos
  if (metadata?.orderId) {
    await orderService.markAsPaid(metadata.orderId, {
      transactionId: payment.transactionId,
      paidAt: payment.paidAt
    });
  }
}