const express = require('express');
const crypto = require('crypto');

const app = express();
app.use(express.json());

app.post('/webhooks/indexpilot', (req, res) => {
  const signature = req.headers['x-indexpilot-signature'];
  const timestamp = req.headers['x-indexpilot-timestamp'];
  const webhookSecret = process.env.INDEXPILOT_WEBHOOK_SECRET;
  
  // Verify the webhook (see verification guide below)
  if (!verifySignature(req.body, signature, webhookSecret, timestamp)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  // Process the article
  const { event, article, site, event_id } = req.body;
  
  console.log('Event ID:', event_id); // Use for idempotency
  console.log('Event type:', event);
  console.log('New article:', article.title);
  console.log('Site:', site.name);
  
  // Add your custom logic here:
  // - Save to your database
  // - Publish to your CMS
  // - Send notifications
  // - Trigger workflows
  
  res.status(200).json({ success: true });
});

app.listen(3000);

const crypto = require('crypto');

function verifySignature(payload, signature, secret, timestamp) {
  // Step 1: Check timestamp (prevent replay attacks)
  const now = Date.now();
  const requestTime = parseInt(timestamp, 10);
  const fiveMinutes = 5 * 60 * 1000;
  
  if (Math.abs(now - requestTime) > fiveMinutes) {
    console.error('Webhook timestamp too old or in future');
    return false;
  }
  
  // Step 2: Compute expected signature
  const payloadString = JSON.stringify(payload);
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payloadString)
    .digest('hex');
  
  // Step 3: Remove 'sha256=' prefix if present
  const providedSignature = signature.replace('sha256=', '');
  
  // Step 4: Timing-safe comparison (prevents timing attacks)
  try {
    return crypto.timingSafeEqual(
      Buffer.from(expectedSignature, 'hex'),
      Buffer.from(providedSignature, 'hex')
    );
  } catch (e) {
    return false;
  }
}

import hmac
import hashlib
import time
import json

def verify_signature(payload, signature, secret, timestamp):
    # Check timestamp (within 5 minutes)
    now = int(time.time() * 1000)
    request_time = int(timestamp)
    five_minutes = 5 * 60 * 1000
    
    if abs(now - request_time) > five_minutes:
        return False
    
    # Compute expected signature
    payload_string = json.dumps(payload, separators=(',', ':'))
    expected_signature = hmac.new(
        secret.encode('utf-8'),
        payload_string.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
    
    # Remove prefix and compare
    provided_signature = signature.replace('sha256=', '')
    
    return hmac.compare_digest(expected_signature, provided_signature)

function verifySignature($payload, $signature, $secret, $timestamp) {
    // Check timestamp
    $now = round(microtime(true) * 1000);
    $requestTime = intval($timestamp);
    $fiveMinutes = 5 * 60 * 1000;
    
    if (abs($now - $requestTime) > $fiveMinutes) {
        return false;
    }
    
    // Compute expected signature
    $payloadString = json_encode($payload);
    $expectedSignature = hash_hmac('sha256', $payloadString, $secret);
    
    // Remove prefix
    $providedSignature = str_replace('sha256=', '', $signature);
    
    // Timing-safe comparison
    return hash_equals($expectedSignature, $providedSignature);
}

{
  "event_id": "a1b2c3d4e5f6...",
  "event": "article.ready",
  "timestamp": "2025-09-30T12:00:00Z",
  "site": {
    "id": "site123",
    "name": "My Site",
    "host": "https://example.com"
  },
  "article": {
    "id": "abc123",
    "slug": "example-article-how-to-build-better-content",
    "title": "Example Article: How to Build Better Content",
    "content": "<h1>Example Article...</h1><p>Full HTML content...</p>",
    "summary": "Learn how to build better content...",
    "seo_title": "Example Article: How to Build Better Content",
    "seo_meta_description": "Learn how to build better content...",
    "target_keyword": "build better content",
    "main_image_url": "https://example.com/images/example.jpg",
    "thumbnail_image_url": "https://example.com/images/example-thumb.jpg",
    "article_type": "explainer",
    "category": "Content Marketing",
    "author_name": "IndexPilot AI",
    "read_time_minutes": 5,
    "is_featured": false,
    "published_at": "2025-09-30T12:30:00Z",
    "created_at": "2025-09-30T12:00:00Z",
    "updated_at": "2025-09-30T12:00:00Z"
  }
}

article.ready

article.published

const processedEvents = new Set(); // In production, use a database

app.post('/webhooks/indexpilot', (req, res) => {
  const { event_id } = req.body;
  
  // Check if already processed
  if (processedEvents.has(event_id)) {
    console.log('Duplicate event, skipping');
    return res.status(200).json({ success: true });
  }
  
  // Process the webhook
  processArticle(req.body);
  
  // Mark as processed
  processedEvents.add(event_id);
  
  res.status(200).json({ success: true });
});