تكامل الويب هوك Webhooks — استلام حالات تسليم رسائل واتساب

// Node.js (Express) Webhook Handler
const express = require('express');
const crypto = require('crypto');

const app = express();
// Keep raw body for accurate cryptographic signature check
app.use(express.json({
  verify: (req, res, buf) => {
    req.rawBody = buf;
  }
}));

const WEBHOOK_SECRET = process.env.EZYCODE_WEBHOOK_SECRET || 'whsec_xxxxxxxx';

app.post('/api/webhook/ezycode', (req, res) => {
  const signature = req.headers['x-ezycode-signature'];

  if (!signature) {
    return res.status(401).json({ error: 'Missing signature header' });
  }

  // Calculate HMAC-SHA256 signature
  const expectedSignature = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(req.rawBody)
    .digest('hex');

  const isValid = crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );

  if (!isValid) {
    return res.status(401).json({ error: 'Invalid HMAC signature' });
  }

  const { event, data, timestamp } = req.body;
  console.log(`Received event ${event} for message ${data.message_id} at ${timestamp}`);

  switch (event) {
    case 'message.delivered':
      // Update DB: recipient device received the message
      break;
    case 'message.read':
      // Update DB: blue ticks (recipient opened message)
      break;
    case 'message.failed':
      // Log failure reason: e.g. invalid phone number or unregistered WhatsApp account
      console.error('Dispatch failed:', data.error_code, data.error_message);
      break;
  }

  // Always respond with 200 OK promptly
  res.status(200).json({ received: true });
});

app.listen(3000, () => console.log('Webhook server running on port 3000'));

<?php
// PHP Webhook Handler
$secret = getenv('EZYCODE_WEBHOOK_SECRET') ?: 'whsec_xxxxxxxx';

$rawPayload = file_get_contents('php://input');
$receivedSignature = $_SERVER['HTTP_X_EZYCODE_SIGNATURE'] ?? '';

if (empty($receivedSignature)) {
    http_response_code(401);
    echo json_encode(['error' => 'Missing signature']);
    exit;
}

$expectedSignature = hash_hmac('sha256', $rawPayload, $secret);

if (!hash_equals($expectedSignature, $receivedSignature)) {
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

$payload = json_decode($rawPayload, true);
$event = $payload['event'] ?? '';
$messageId = $payload['data']['message_id'] ?? null;
$status = $payload['data']['status'] ?? null;

// Handle idempotent database update
// ...

http_response_code(200);
echo json_encode(['received' => true]);