Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

const SECRET = process.env.POSTBREEZE_WEBHOOK_SECRET!;

export async function POST(req: Request): Promise<Response> {
  const raw = await req.text();
  const sig = req.headers.get("x-postbreeze-signature");

  if (!sig || !verify(raw, sig, SECRET)) {
    return new Response("Invalid signature", { status: 401 });
  }

  const event = JSON.parse(raw) as {
    event: string;
    deliveryId: string;
    sentAt: string;
    payload: Record<string, unknown>;
  };

  // Acknowledge quickly. Move heavy work to a queue.
  void enqueueBackgroundJob(event);
  return new Response("ok", { status: 200 });
}

/** Verifies a `t=<unix>,v1=<hex>` header against the raw body. */
function verify(body: string, header: string, secret: string): boolean {
  const parts = Object.fromEntries(
    header.split(",").map((p) => p.split("=") as [string, string]),
  );
  const ts = parts.t;
  const sig = parts.v1;
  if (!ts || !sig) return false;

  // Reject deliveries older than 5 minutes — defends against replay
  // attacks once an attacker has a leaked body + signature.
  const ageSec = Math.floor(Date.now() / 1000) - Number(ts);
  if (!Number.isFinite(ageSec) || Math.abs(ageSec) > 5 * 60) return false;

  const expected = createHmac("sha256", secret)
    .update(`${ts}.${body}`)
    .digest("hex");
  const a = Buffer.from(sig, "hex");
  const b = Buffer.from(expected, "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}

{
  postId: string;
  workspaceId: string;
  publishedAt: string;     // ISO-8601
  targetCount: number;
}

{
  postId: string;
  workspaceId: string;
  successCount: number;
  failureCount: number;
}

{
  postId: string;
  workspaceId: string;
  targetId: string;
  platform: string;        // "INSTAGRAM" | "X" | "TIKTOK_PERSONAL" | …
  externalPostId: string | null;
  externalUrl: string | null;
  publishedAt: string;
}

{
  postId: string;
  workspaceId: string;
  targetId: string;
  platform: string;
  errorCode: string | null;
  errorMessage: string | null;
}

{
  accountId: string;
  workspaceId: string;
  platform: string;
  handle: string;
  displayName: string | null;
  reconnected: boolean;    // true when a previously-disconnected row was revived
}

{
  accountId: string;
  workspaceId: string;
  platform: string;
  handle: string;
  reason: "user_initiated" | "external_revocation";
}

{
  commentId: string;
  workspaceId: string;
  socialAccountId: string;
  platform: string;
  externalPostId: string | null;
  authorHandle: string | null;
  body: string;
  createdAt: string;
}

{
  webhookId: string;
  reason: "consecutive_failure_threshold_reached";
  failureStreak: number;
}