Track delivery with webhooks

import crypto from "crypto";
import express from "express";

const app = express();

// Capture the raw body so the signature matches the exact bytes Courier hashed.
app.post("/courier-webhook", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("courier-signature") ?? "";
  const parts = Object.fromEntries(header.split(",").map((kv) => kv.split("=")));
  const expected = crypto
    .createHmac("sha256", process.env.COURIER_WEBHOOK_SECRET)
    .update(`${parts.t}.${req.body.toString("utf8")}`, "utf8")
    .digest("hex");

  const digest = Buffer.from(expected, "hex");
  const provided = Buffer.from(parts.signature ?? "", "hex");

  // timingSafeEqual throws unless both buffers are the same length. Compare
  // lengths first, or a forged signature becomes a 500 instead of a 401, and
  // Courier retries a 500.
  const valid =
    provided.length === digest.length && crypto.timingSafeEqual(digest, provided);
  if (!valid) return res.sendStatus(401);

  const { type, data } = JSON.parse(req.body.toString("utf8"));
  if (type === "message:updated") {
    // Sync the delivery status to your system.
    console.log(data.id, data.status);
  }

  res.sendStatus(200); // Acknowledge fast; do slow work asynchronously.
});