Nhận sự kiện Sellfern bằng Webhook

curl -X POST "https://api.sellfern.com/api/v2/webhooks" \
  -H "Authorization: Bearer sk_live_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/webhooks/sellfern",
    "events": ["order.created", "order.status_changed"]
  }'

{
  "event": "order.status_changed",
  "order_id": 10482,
  "old_status": "In Production",
  "new_status": "Shipped",
  "tracking_number": "1Z999AA10123456784",
  "carrier": "UPS",
  "occurred_at": "2026-05-22T09:14:32Z"
}

const crypto = require('crypto');

function verifySignature(req, secret) {
  const signature = req.headers['x-sellfern-signature'];
  const expected = crypto
    .createHmac('sha256', secret)
    .update(req.rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expected, 'hex')
  );
}

app.post('/webhook', async (req, res) => {
  // 1. Từ chối payload có chữ ký không hợp lệ
  if (!verifySignature(req)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = req.headers['x-sellfern-event'];

  // 2. Chỉ hành động trên order.status_changed; xác nhận im lặng mọi thứ khác
  if (event !== 'order.status_changed') {
    return res.status(200).json({ received: true, handled: false });
  }

  // 3. Xây embed Discord từ payload và đăng nó
  const embed = buildEmbed(req.body);
  await postToDiscord(embed);
  return res.status(200).json({ received: true, handled: true });
});