Webhook

Content-Type: application/json
X-Gift30t-Event: order.created
X-Gift30t-Signature: 9dfbf12d...

{
  "event": "order.created",
  "timestamp": "2026-07-24T08:30:00.000Z",
  "data": {
    "orderId": 5678,
    "orderReference": "A1234567",
    "amount": 490000,
    "status": "PREPARING",
    "items": 1
  }
}

import crypto from "node:crypto";

function verifyGiftCityWebhook(payload, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(JSON.stringify(payload))
    .digest("hex");

  const receivedBuffer = Buffer.from(signature || "", "hex");
  const expectedBuffer = Buffer.from(expected, "hex");

  return (
    receivedBuffer.length === expectedBuffer.length &&
    crypto.timingSafeEqual(receivedBuffer, expectedBuffer)
  );
}

app.post("/webhooks/giftcity", express.json(), (req, res) => {
  const event = req.header("X-Gift30t-Event");
  const signature = req.header("X-Gift30t-Signature");

  if (!verifyGiftCityWebhook(req.body, signature, process.env.WEBHOOK_SECRET)) {
    return res.status(401).json({ error: "Invalid signature" });
  }

  // ابتدا دریافت را ثبت کنید؛ پردازش سنگین را به queue بسپارید.
  queue.add("giftcity-webhook", { event, payload: req.body });
  return res.sendStatus(204);
});