import { createServer } from "node:http";
import { createHmac, timingSafeEqual } from "node:crypto";
import { open, readFile } from "node:fs/promises";

const secret = process.env.LINNET_WEBHOOK_SECRET;
if (!secret) throw new Error("Set LINNET_WEBHOOK_SECRET first.");
const receiptFile = "linnet-events.jsonl";
const prior = await readFile(receiptFile, "utf8").catch((error) => {
  if (error.code === "ENOENT") return "";
  throw error;
});
const seen = new Set(prior.split("\n").filter(Boolean).map((line) => JSON.parse(line).id));
let writes = Promise.resolve();
function acceptOnce(event) {
  const next = writes.then(async () => {
    if (seen.has(event.id)) return;
    const file = await open(receiptFile, "a");
    try {
      await file.writeFile(JSON.stringify({ id: event.id, type: event.type }) + "\n");
      await file.sync();
    } finally { await file.close(); }
    seen.add(event.id);
  });
  writes = next.catch(() => {});
  return next;
}
createServer(async (req, res) => {
  if (req.method !== "POST" || req.url !== "/webhooks/linnet") {
    res.writeHead(404).end(); return;
  }
  try {
    const chunks = [];
    let size = 0;
    for await (const chunk of req) {
      size += chunk.length;
      if (size > 1024 * 1024) { res.writeHead(413).end(); return; }
      chunks.push(chunk);
    }
    const raw = Buffer.concat(chunks);
    const id = req.headers["linnet-webhook-id"];
    const stampText = req.headers["linnet-webhook-timestamp"];
    const stamp = Number(stampText);
    if (typeof id !== "string" || !id || typeof stampText !== "string" ||
        !/^\d+$/.test(stampText) || !Number.isSafeInteger(stamp) ||
        Math.abs(Date.now() / 1000 - stamp) > 300) {
      res.writeHead(400).end(); return;
    }
    const expected = createHmac("sha256", secret)
      .update(id + "." + stamp + ".").update(raw).digest();
    const signatures = String(req.headers["linnet-webhook-signature"] || "")
      .split(/[\s,]+/).filter((value) => value.startsWith("v1="));
    const valid = signatures.some((value) => {
      const actual = Buffer.from(value.slice(3), "base64url");
      return actual.length === expected.length && timingSafeEqual(actual, expected);
    });
    if (!valid) { res.writeHead(400).end(); return; }
    const event = JSON.parse(raw.toString("utf8"));
    if (typeof event?.id !== "string" || !event.id || typeof event.type !== "string") {
      res.writeHead(400).end(); return;
    }
    await acceptOnce(event);
    res.writeHead(204).end();
  } catch { res.writeHead(503).end(); }
}).listen(Number(process.env.PORT || 3000), "127.0.0.1");