توثيق Webhooks

{
  "event": "order.created",
  "timestamp": "2026-01-27T12:00:00Z",
  "storeId": "store_abc123",
  "data": {
    "orderId": "ord_789",
    "status": "pending",
    "total": 249.99,
    "currency": "SAR",
    "items": [
      { "productId": "prod_1", "name": "Wireless Headphones", "qty": 1, "price": 249.99 }
    ],
    "customer": { "id": "cust_456", "email": "customer@example.com" }
  }
}

const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const computed = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(computed)
  );
}

// Express handler
app.post('/webhooks/zalink', (req, res) => {
  const signature = req.headers['x-zalink-signature'];
  const isValid = verifyWebhook(
    JSON.stringify(req.body),
    signature,
    process.env.WEBHOOK_SECRET
  );
  if (!isValid) return res.status(401).send('Invalid signature');

  const { event, data } = req.body;
  switch (event) {
    case 'order.created':
      handleNewOrder(data);
      break;
    case 'product.updated':
      syncProduct(data);
      break;
  }
  res.json({ received: true });
});