import crypto from "node:crypto";
import express from "express";

const app = express();
// Keep the raw body: the HMAC is computed over the exact bytes Orbit signed.
app.use(express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }));

const seen = new Set(); // back with Redis or your store in production

app.post("/webhooks/orbit", (req, res) => {
  const signature = req.headers["x-orbit-webhook-signature"];
  const webhookId = req.headers["x-webhook-id"];

  const expected = crypto
    .createHmac("sha256", process.env.ORBIT_WEBHOOK_SECRET)
    .update(req.rawBody)
    .digest("hex");

  if (!signature || signature !== expected) {
    return res.sendStatus(401); // reject unsigned or tampered deliveries
  }
  if (seen.has(webhookId)) {
    return res.sendStatus(200); // retry of an already-processed delivery
  }
  seen.add(webhookId);

  const event = req.body;
  if (event.event === "message.received" && event.channel === "web_chat") {
    saveInbound({
      visitor: event.message.from,   // the visitor id from the session bootstrap
      text: event.message.text ?? "",
    });
  }

  res.sendStatus(200);
});

import hashlib
import hmac
import os

from flask import Flask, request

app = Flask(__name__)
seen = set()  # back with Redis or your store in production


@app.post("/webhooks/orbit")
def handle_webhook():
    signature = request.headers.get("X-Orbit-Webhook-Signature")
    webhook_id = request.headers.get("X-Webhook-Id")

    expected = hmac.new(
        os.environ["ORBIT_WEBHOOK_SECRET"].encode(),
        request.get_data(),  # exact bytes Orbit signed
        hashlib.sha256,
    ).hexdigest()

    if not signature or not hmac.compare_digest(signature, expected):
        return "", 401  # reject unsigned or tampered deliveries
    if webhook_id in seen:
        return "", 200  # retry of an already-processed delivery
    seen.add(webhook_id)

    event = request.get_json() or {}
    if event.get("event") == "message.received" and event.get("channel") == "web_chat":
        message = event.get("message") or {}
        save_inbound(visitor=message.get("from"), text=message.get("text", ""))

    return "", 200