import { createServer } from 'http';
import { verify } from '@noble/ed25519';

const PUBLIC_KEY = process.env.OPENPAY_WEBHOOK_PUBLIC_KEY!;
const TOLERANCE_SECONDS = 300; // 5 minutes

async function verifyWebhook(
  signature: string,
  timestamp: string,
  body: string
): Promise<boolean> {
  // 1. Check timestamp freshness
  const ts = parseInt(timestamp, 10);
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - ts) > TOLERANCE_SECONDS) {
    console.error('Webhook timestamp too old');
    return false;
  }

  // 2. Construct signed message
  const message = new TextEncoder().encode(`${timestamp}.${body}`);

  // 3. Verify ED25519 signature
  const sig = Buffer.from(signature, 'base64');
  const pubKey = Buffer.from(PUBLIC_KEY, 'base64');

  return await verify(sig, message, pubKey);
}

// Express example
import express from 'express';
const app = express();

app.post(
  '/webhooks/openpay',
  express.raw({ type: 'application/json' }),
  async (req, res) => {
    const signature = req.headers['x-openpay-signature'] as string;
    const timestamp = req.headers['x-openpay-timestamp'] as string;
    const body = req.body.toString();

    const isValid = await verifyWebhook(signature, timestamp, body);
    if (!isValid) {
      return res.status(401).json({ error: 'Invalid signature' });
    }

    const event = JSON.parse(body);

    switch (event.event) {
      case 'payment.completed':
        await fulfillOrder(event.data.payment_id, event.data.metadata);
        break;
      case 'payment.failed':
        await handleFailedPayment(event.data.payment_id);
        break;
      case 'payment.expired':
        await handleExpiredPayment(event.data.payment_id);
        break;
      case 'subscription.renewed':
        await extendSubscription(event.data);
        break;
      case 'subscription.cancelled':
        await cancelSubscription(event.data);
        break;
    }

    res.status(200).json({ received: true });
  }
);