Welcome to BabyGo Documentations

import crypto from "node:crypto";
import express from "express";

const app = express();
const WEBHOOK_SECRET = process.env.BABYGO_WEBHOOK_SECRET;

function verifyBabyGoSignature({ rawBody, signature, timestamp, secret }) {
  const expected = "v1=" + crypto
    .createHmac("sha256", secret)
    .update(timestamp + "." + rawBody)
    .digest("hex");

  const left = Buffer.from(signature || "", "utf8");
  const right = Buffer.from(expected, "utf8");

  if (left.length !== right.length) return false;
  return crypto.timingSafeEqual(left, right);
}

app.post(
  "/webhooks/babygo",
  express.raw({ type: "application/json" }),
  async (req, res) => {
    const rawBody = req.body.toString("utf8");
    const signature = req.get("X-Signature");
    const timestamp = req.get("X-Callback-Timestamp");
    const callbackId = req.get("X-Callback-Id");
    const eventHeader = req.get("X-Callback-Event");

    if (!signature || !timestamp || !callbackId) {
      return res.status(401).json({ error: "Missing required headers" });
    }

    const ok = verifyBabyGoSignature({ rawBody, signature, timestamp, secret: WEBHOOK_SECRET });
    if (!ok) {
      return res.status(401).json({ error: "Invalid signature" });
    }

    const ageMs = Math.abs(Date.now() - new Date(timestamp).getTime());
    if (Number.isNaN(ageMs) || ageMs > 5 * 60 * 1000) {
      return res.status(401).json({ error: "Timestamp expired" });
    }

    const payload = JSON.parse(rawBody);
    const event = eventHeader || payload.event;
    console.log("Verified event:", event);

    return res.json({ ok: true });
  }
);