Webhook 設定

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(payload))
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// 在你的 Webhook 端點中使用
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const isValid = verifyWebhookSignature(req.body, signature, 'your_webhook_secret');

  if (!isValid) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // 處理 Webhook 事件
  const event = req.body.event;
  console.log('收到事件:', event);

  res.status(200).json({ received: true });
});

use Illuminate\Http\Request;

Route::post('/webhook', function (Request $request) {
    $signature = $request->header('X-Webhook-Signature');
    $payload = $request->getContent();
    $secret = config('services.zangsho.webhook_secret');

    $expectedSignature = hash_hmac('sha256', $payload, $secret);

    if (!hash_equals($expectedSignature, $signature)) {
        return response()->json(['error' => 'Invalid signature'], 401);
    }

    // 處理 Webhook 事件
    $event = $request->input('event');
    Log::info('收到 Webhook 事件', ['event' => $event]);

    return response()->json(['received' => true]);
});