Webhooks

const crypto = require("crypto");

function verifyKarzounWebhook(req, secret) {
  const header = req.headers["x-karzoun-signature-256"];
  if (!header || !header.startsWith("sha256=")) return false;

  const expected = header.slice("sha256=".length);
  const computed = crypto
    .createHmac("sha256", secret)
    .update(req.rawBody, "utf8") // use the raw body string/buffer
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(computed, "hex"),
  );
}

$secret = getenv('WEBHOOK_SECRET');
$header = $_SERVER['HTTP_X_KARZOUN_SIGNATURE_256'] ?? '';
$body = file_get_contents('php://input');

if (!str_starts_with($header, 'sha256=')) {
  http_response_code(401);
  exit;
}

$expected = substr($header, 7);
$computed = hash_hmac('sha256', $body, $secret);

if (!hash_equals($expected, $computed)) {
  http_response_code(401);
  exit;
}

http_response_code(200);

mutation {
  webhooksAdd(
    url: "https://api.example.com/karzoun/events"
    name: "CRM + inbox sync"
    description: "Customer and conversation updates"
    actions: [
      { type: "core:customer", action: "create" }
      { type: "core:customer", action: "update" }
      { type: "inbox:conversation", action: "create" }
      { type: "inbox:conversation", action: "assign" }
      { type: "whatsapp:flow", action: "completed" }
    ]
    retryPolicy: { maxAttempts: 3, backoffMs: [5000, 30000, 120000] }
  ) {
    _id
    url
    token
    secret
    actions {
      type
      action
      label
    }
    retryPolicy {
      maxAttempts
      backoffMs
    }
  }
}

curl -X POST 'https://YOUR_SUBDOMAIN.api.karzoun.chat/graphql' \
  -H 'Content-Type: application/json' \
  -H 'x-app-token: YOUR_APP_TOKEN' \
  -d '{
    "query": "mutation { webhooksAdd(url: \"https://api.example.com/karzoun/events\", name: \"My hook\", actions: [{ type: \"core:customer\", action: \"update\" }]) { _id token secret } }"
  }'