Webhook de Pagamento

{
  "event": "subscription.activated",
  "data": {
    "subscription_id": "550e8400-e29b-41d4-a716-446655440000",
    "product_id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
    "product_name": "Club EasyGoal",
    "user_email": "usuario@email.com",
    "user_name": "João Silva",
    "amount": 9900,
    "frequency": "MONTHLY",
    "started_at": "2026-02-22T10:00:00.000Z",
    "is_test": false
  },
  "timestamp": "2026-02-22T10:00:00.000Z",
  "signature": "a3f8b2c1d4e5f6..."
}

// app-front → utilitário de webhook
import { createHmac } from 'crypto';

function signWebhook(payload: object, secret: string): string {
  return createHmac('sha256', secret)
    .update(JSON.stringify(payload))
    .digest('hex');
}

// Enviando o webhook
const body = { event, data, timestamp };
const signature = signWebhook(body, process.env.SSO_WEBHOOK_SECRET!);

await fetch(process.env.SSO_WEBHOOK_URL!, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ ...body, signature }),
});

import { createHmac, timingSafeEqual } from 'crypto';

const { signature, ...bodyWithoutSignature } = payload;

const expectedSignature = createHmac('sha256', process.env.APP_WEBHOOK_SECRET!)
  .update(JSON.stringify(bodyWithoutSignature))
  .digest('hex');

const sigBuffer = Buffer.from(signature, 'hex');
const expectedBuffer = Buffer.from(expectedSignature, 'hex');

const isValid =
  sigBuffer.length === expectedBuffer.length &&
  timingSafeEqual(sigBuffer, expectedBuffer);

// 200 OK
{ "received": true }

// 400 Bad Request
{ "error": "Payload invalido" }

// 401 Unauthorized
{ "error": "Assinatura ausente" }
{ "error": "Assinatura invalida" }