// Express.js
app.post('/webhooks/simiz', express.json(), (req, res) => {
  const event = req.body;
  console.log('Webhook reçu:', event.type);
  // Traiter l'événement
  res.status(200).json({ received: true });
});

X-Simiz-Signature: t=<timestamp>,v1=<hmac_sha256_hex>

const crypto = require('crypto');
function verifySignature(payload, signatureHeader, secret) {
  // Parser le header: t=<timestamp>,v1=<hash>
  const parts = signatureHeader.split(',');
  let timestamp, hash;
  for (const part of parts) {
    if (part.startsWith('t=')) timestamp = parseInt(part.slice(2));
    else if (part.startsWith('v1=')) hash = part.slice(3);
  }
  if (!timestamp || !hash) return false;
  // Vérifier que le timestamp est récent (tolérance: 5 minutes)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - timestamp) > 300) {
    return false; // Rejet pour replay attack
  }
  // Calculer la signature attendue
  const signaturePayload = ${timestamp}.${payload};
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signaturePayload)
    .digest('hex');
  // Comparaison timing-safe
  return crypto.timingSafeEqual(
    Buffer.from(hash, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  );
}
// Utilisation
app.post('/webhooks/simiz', express.raw({type: 'application/json'}), (req, res) => {
  const signature = req.headers['x-simiz-signature'];
  const payload = req.body.toString();
  if (!verifySignature(payload, signature, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }
  // Traiter l'événement...
  res.status(200).json({ received: true });
});