Webhooks

curl -X POST "https://alpa-sistema-api.onrender.com/api/v1/webhooks/subscriptions" \
  -H "Authorization: Bearer SUA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://meusite.com.br/webhooks/alpa",
    "events": ["transaction.completed", "transaction.failed"],
    "description": "Webhook para notificações de transação"
  }'

{
  "success": true,
  "data": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "url": "https://meusite.com.br/webhooks/alpa",
    "events": ["transaction.completed", "transaction.failed"],
    "description": "Webhook para notificações de transação",
    "status": "ACTIVE",
    "secret": "whsec_abc123...",
    "createdAt": "2025-12-30T00:00:00.000Z"
  }
}

const response = await fetch('https://alpa-sistema-api.onrender.com/api/v1/webhooks/subscriptions', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${apiKey}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    url: 'https://meusite.com.br/webhooks/alpa',
    events: [
      'transaction.completed',
      'transaction.failed'
    ],
    description: 'Webhook para processar notificações de pagamento'
  })
});

const { data } = await response.json();
console.log('Webhook Secret:', data.secret);

curl -X GET "https://alpa-sistema-api.onrender.com/api/webhooks/subscriptions" \
  -H "Authorization: Bearer SUA_API_KEY"

curl -X GET "https://alpa-sistema-api.onrender.com/api/webhooks/events?page=1&limit=20" \
  -H "Authorization: Bearer SUA_API_KEY"

curl -X PUT "https://alpa-sistema-api.onrender.com/api/webhooks/subscriptions/{id}" \
  -H "Authorization: Bearer SUA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://meusite.com.br/webhooks/alpa-v2",
    "events": ["transaction.completed", "transaction.failed"],
    "isActive": true
  }'

curl -X DELETE "https://alpa-sistema-api.onrender.com/api/webhooks/subscriptions/{id}" \
  -H "Authorization: Bearer SUA_API_KEY"

const crypto = require('crypto');

function verifySignature(payload, signatureHeader, secret) {
  const [algorithm, signature] = signatureHeader.split('=');

  if (algorithm !== 'sha256') return false;

  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// No seu endpoint de webhook
app.post('/webhooks/alpa', express.json(), (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const secret = process.env.ALPA_WEBHOOK_SECRET;

  if (!verifySignature(req.rawBody, signature, secret)) { // req.rawBody é necessário para a validação
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // Processar webhook
  const event = req.body;
  console.log('Evento recebido:', event.type);

  res.status(200).json({ received: true });
});

import hmac
import hashlib
import json

def validate_webhook_signature(payload, signature, secret):
    expected_signature = hmac.new(
        secret.encode('utf-8'),
        json.dumps(payload).encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
    
    return hmac.compare_digest(signature, expected_signature)

# No seu endpoint de webhook
@app.route('/webhooks/alpa', methods=['POST'])
def webhook():
    signature = request.headers.get('X-Webhook-Signature', '').replace('sha256=', '')
    secret = os.getenv('ALPA_WEBHOOK_SECRET')
    
    if not validate_webhook_signature(request.json, signature, secret):
        return jsonify({'error': 'Invalid signature'}), 401
    
    # Processar webhook
    event = request.json
    print(f"Evento recebido: {event['type']}")
    
    return jsonify({'received': True}), 200

{
  "id": "evt_5f9d7a2b-1234-5678-90ab-cdef12345678",
  "type": "transaction.completed",
  "timestamp": "2024-03-15T10:30:00.000Z",
  "data": {
    "id": "tx_240315_a7b2c9",
    "userId": "usr_987654321",
    "value": 150.00,
    "amountCents": 15000,
    "status": "PAID",
    "paymentMethod": "PIX",
    "paymentDate": "2024-03-15T10:29:55.000Z",
    "completedAt": "2024-03-15T10:30:00.000Z"
  },
  "subscription": {
    "id": "sub_12345678",
    "url": "https://suaapiv1.com/webhooks"
  }
}

{
  "id": "evt_def456",
  "type": "transaction.failed",
  "createdAt": "2025-12-30T00:00:00.000Z",
  "data": {
    "transactionId": "550e8400-e29b-41d4-a716-446655440000",
    "paymentLinkId": "550e8400-e29b-41d4-a716-446655440001",
    "amount": 199.00,
    "amountCents": 19900,
    "currency": "BRL",
    "paymentMethod": "credit_card",
    "status": "FAILED",
    "error": "Cartão recusado",
    "errorCode": "CARD_DECLINED"
  }
}

# Instale o ngrok
npm install -g ngrok

# Exponha sua aplicação local
ngrok http 3000

# Use a URL do ngrok na assinatura do webhook
# Ex: https://abc123.ngrok.io/webhooks/alpa

app.post('/webhooks/alpa', express.json(), (req, res) => {
  console.log('Webhook recebido:', JSON.stringify(req.body, null, 2));
  res.status(200).json({ received: true });
});