Receitas de integração

const TOLERANCE_SECONDS = 300;

async function hmacHex(secret, message) {
  const key = await crypto.subtle.importKey(
    "raw",
    new TextEncoder().encode(secret),
    { name: "HMAC", hash: "SHA-256" },
    false,
    ["sign"],
  );
  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(message));
  return [...new Uint8Array(sig)].map((b) => b.toString(16).padStart(2, "0")).join("");
}

function timingSafeEqual(a, b) {
  if (a.length !== b.length) return false;
  let diff = 0;
  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
  return diff === 0;
}

export default {
  async fetch(request, env, ctx) {
    if (request.method !== "POST") return new Response("method not allowed", { status: 405 });

    // Corpo BRUTO — leia uma vez, use para o HMAC e só depois faça parse.
    const raw = await request.text();

    const header = request.headers.get("x-tryno-signature") ?? "";
    const parts = Object.fromEntries(
      header.split(",").map((kv) => {
        const i = kv.indexOf("=");
        return [kv.slice(0, i).trim(), kv.slice(i + 1).trim()];
      }),
    );
    const t = Number(parts.t);
    if (!Number.isFinite(t) || !parts.v1) return new Response("bad signature", { status: 401 });
    if (Math.abs(Date.now() / 1000 - t) > TOLERANCE_SECONDS) {
      return new Response("stale", { status: 401 });
    }

    const expected = await hmacHex(env.TRYNO_WEBHOOK_SECRET, `${t}.${raw}`);
    if (!timingSafeEqual(expected, parts.v1)) {
      return new Response("bad signature", { status: 401 });
    }

    // Dedupe pelo id estável da entrega (KV com TTL de 7 dias basta).
    const deliveryId = request.headers.get("x-tryno-delivery") ?? "";
    if (await env.SEEN.get(deliveryId)) return new Response(null, { status: 204 });
    await env.SEEN.put(deliveryId, "1", { expirationTtl: 604_800 });

    // Repasse para a ferramenta no-code fora do caminho da resposta:
    // responder rápido evita o timeout de 10s e a reentrega.
    ctx.waitUntil(
      fetch(env.DOWNSTREAM_URL, {
        method: "POST",
        headers: { "content-type": "application/json" },
        body: raw,
      }),
    );

    return new Response(null, { status: 204 });
  },
};