Yanitly Kurumsal Webhook Entegrasyonu

import crypto from 'node:crypto';
import express from 'express';

const app = express();

// Ham JSON gövdesini (raw body) string olarak saklayın:
app.use(express.json({
  verify: (req, _res, buf) => {
    (req as any).rawBody = buf.toString('utf-8');
  }
}));

function verifyYanitlySignature(
  rawBody: string,
  signatureHeader: string | undefined,
  secret: string,
  toleranceSeconds = 300 // 5 dakika replay attack toleransı
): boolean {
  if (!signatureHeader || !rawBody) return false;

  const parts = signatureHeader.split(',');
  const timestampPart = parts.find((p) => p.startsWith('t='));
  const signatureParts = parts.filter((p) => p.startsWith('v1='));

  if (!timestampPart || signatureParts.length === 0) return false;

  const timestamp = Number(timestampPart.slice(2));
  if (isNaN(timestamp)) return false;

  // Replay Attack Koruması
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - timestamp) > toleranceSeconds) {
    console.error('Webhook zaman damgası tolerans dışı (Replay attack şüphesi)');
    return false;
  }

  // Beklenen HMAC-SHA256 hesaplama: secret + "t.payload"
  const expectedSig = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`, 'utf-8')
    .digest('hex');

  // Sıfır-kesintili rotasyonda v1=yeni,v1=eski şeklinde birden fazla v1 gelebilir
  return signatureParts.some((part) => {
    const candidateSig = part.slice(3);
    if (candidateSig.length !== expectedSig.length) return false;
    return crypto.timingSafeEqual(
      Buffer.from(candidateSig),
      Buffer.from(expectedSig)
    );
  });
}

app.post('/api/webhooks/yanitly', (req, res) => {
  const signature = req.headers['yanitly-signature'] as string;
  const rawBody = (req as any).rawBody;

  const isValid = verifyYanitlySignature(rawBody, signature, process.env.YANITLY_WEBHOOK_SECRET!);
  if (!isValid) {
    return res.status(401).json({ error: 'Invalid Yanitly-Signature' });
  }

  const { id, type, data, time, sector } = req.body;
  console.log(`[Yanitly Webhook] Olay: ${type} (ID: ${id}, Sektör: ${sector})`);

  // Asenkron işlem kuyruğuna alın ve hemen 200 dönün
  res.status(200).json({ received: true });
});