Webhooks

import express from 'express';
import crypto from 'crypto';

const app = express();
app.use(express.raw({ type: 'application/json' }));

const WEBHOOK_SECRET = process.env.STYX_WEBHOOK_SECRET!;

app.post('/webhooks/styx', (req, res) => {
  const signature = req.headers['x-styx-signature'] as string;
  const timestamp = req.headers['x-styx-timestamp'] as string;
  
  // Verify signature
  const payload = `${timestamp}.${req.body.toString()}`;
  const expectedSignature = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(payload)
    .digest('hex');
  
  if (!crypto.timingSafeEqual(
    Buffer.from(signature), 
    Buffer.from(expectedSignature)
  )) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  // Verify timestamp is within 5 minutes
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    return res.status(401).json({ error: 'Timestamp too old' });
  }
  
  // Process the event
  const event = JSON.parse(req.body.toString());
  console.log('Received event:', event.type);
  
  switch (event.type) {
    case 'message.received':
      handleNewMessage(event.data);
      break;
    case 'airdrop.claimed':
      handleAirdropClaim(event.data);
      break;
    // ... handle other events
  }
  
  // Always return 200 quickly
  res.json({ received: true });
});

app.listen(3000);