Personel devam webhook entegrasyonu

{
  "pbs": {
    "webhookUrl": "https://partner.example.com/hooks/pbs",
    "webhookSecret": "generate-a-long-random-secret"
  }
}

{
  "event": "pbs.attendance.recorded",
  "tenantId": "demo-firma",
  "userId": "usr_abc123",
  "siteId": "550e8400-e29b-41d4-a716-446655440000",
  "eventType": "in",
  "eventId": "660e8400-e29b-41d4-a716-446655440001",
  "recordedAt": "2026-06-11T10:00:00.000Z",
  "distanceM": 8.1
}

import { createHmac, timingSafeEqual } from 'node:crypto';

/** Raw POST body string — do not re-serialize parsed JSON. */
export function verifyPbsWebhookSignature(rawBody, secret, signatureHeader) {
  if (!secret || !signatureHeader) return false;
  const expected = createHmac('sha256', secret).update(rawBody, 'utf8').digest('hex');
  const received = String(signatureHeader).replace(/^sha256=/i, '').trim();
  if (expected.length !== received.length) return false;
  return timingSafeEqual(Buffer.from(expected, 'utf8'), Buffer.from(received, 'utf8'));
}

// Express example:
// app.post('/hooks/pbs', express.raw({ type: 'application/json' }), (req, res) => {
//   const ok = verifyPbsWebhookSignature(
//     req.body.toString('utf8'),
//     process.env.PBS_WEBHOOK_SECRET,
//     req.headers['x-pbs-signature'],
//   );
//   if (!ok) return res.status(401).send('invalid signature');
//   const payload = JSON.parse(req.body.toString('utf8'));
//   if (payload.event !== 'pbs.attendance.recorded') return res.status(400).end();
//   res.status(200).json({ ok: true });
// });