Webhooks

import crypto from 'crypto';

const TOLERANCE_SECONDS = 300; // 5-minute replay window

function parseSignatureHeader(header) {
  // Format: "t=<unix_ts>,v1=<hex_hmac>"
  let timestamp = null;
  let signature = null;
  for (const part of header.split(',')) {
    const [key, value] = part.trim().split('=', 2);
    if (key === 't') timestamp = parseInt(value, 10);
    else if (key === 'v1') signature = value;
  }
  if (!timestamp || !signature) return null;
  return { timestamp, signature };
}

function verifyWebhookSignature(rawBody, header, secret) {
  const parsed = parseSignatureHeader(header || '');
  if (!parsed) return false;

  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parsed.timestamp) > TOLERANCE_SECONDS) {
    return false; // expired or replayed
  }

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${parsed.timestamp}.${rawBody}`, 'utf8')
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(parsed.signature, 'hex'),
  );
}

// In your webhook handler — IMPORTANT: pass the raw request body, not JSON.parse(body):
app.post('/webhooks/billerapi',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const isValid = verifyWebhookSignature(
      req.body.toString('utf8'),
      req.headers['billbutler-signature'],
      process.env.WEBHOOK_SECRET,
    );

    if (!isValid) {
      return res.status(401).json({ error: 'Invalid signature' });
    }

    const event = JSON.parse(req.body.toString('utf8'));
    // Process the event...
    res.status(200).json({ received: true });
  });

// cursor is null on the very first sync (full history from zero).
let cursor = await loadCursor(linkId); // null or your stored high-water mark
let hasMore = true;

while (hasMore) {
  const params = new URLSearchParams({ limit: '200' });
  if (cursor) params.set('cursor', cursor);

  const res = await fetch(
    `https://sandbox.api.billerapi.com/v1/account-links/${linkId}/bills/sync?${params}`,
    {
      headers: {
        'Authorization': 'Bearer $BILLERAPI_API_KEY',
      },
    },
  );

  if (!res.ok) {
    const error = await res.json();
    // INVALID_CURSOR → your stored cursor is corrupt. Drop it and re-sync
    // from zero (omit the cursor); a full sync is idempotent via bill_id.
    if (error.error_code === 'INVALID_CURSOR') {
      cursor = null;
      continue;
    }
    throw new Error(error.error_message);
  }

  const { data } = await res.json();

  // Dedupe key is bill_id — upsert added + modified, delete removed.
  for (const bill of [...data.added, ...data.modified]) upsertBill(bill);
  for (const bill of data.removed) removeBill(bill.id);

  cursor = data.next_cursor;
  hasMore = data.has_more;
}

// Persist ONLY after the drain completes (has_more === false).
await saveCursor(linkId, cursor);