Webhooks

{
  "event": "client.woku-review.created",
  "timestamp": "2026-05-26T15:30:00Z",
  "companyId": "64a1b2c3d4e5f6a7b8c9d0e1",
  "data": {
    "reviewId": "64b2c3d4e5f6a7b8c9d0e1f2",
    "wokuId": "64d4e5f6a7b8c9d0e1f2a3b4",
    "qualification": 5,
    "comment": "Excelente atención",
    "respondentId": "user_abc123",
    "channel": "web-widget",
    "createdAt": "2026-05-26T15:29:58Z"
  }
}

import crypto from 'node:crypto';

function verifyWokuSignature(rawBody, signatureHeader, secret) {
  // signatureHeader: "sha256=<hex>"
  const expected =
    'sha256=' +
    crypto.createHmac('sha256', secret).update(rawBody).digest('hex');

  const a = Buffer.from(signatureHeader);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Ejemplo con Express. Usa el cuerpo crudo, no el JSON parseado.
import express from 'express';
const app = express();

app.post(
  '/webhooks/woku',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.header('X-Woku-Signature') ?? '';
    if (!verifyWokuSignature(req.body, signature, process.env.WOKU_WEBHOOK_SECRET)) {
      return res.status(401).send('Invalid signature');
    }
    const event = JSON.parse(req.body.toString('utf8'));
    // ... procesa el evento
    res.status(200).json({ received: true });
  },
);