Webhooks

POST https://seu-servidor.com/webhook
Content-Type: application/json
X-Voop-Signature: t=1714000000,v1=a1b2c3...
X-Voop-Event-Type: item.created
X-Voop-Event-Id: 01HXYZ...
User-Agent: Voop-Webhooks/1.0

{
  "id": "01HXYZ...",
  "type": "item.created",
  "catalogId": "catalog-uuid",
  "resourceId": "PROD-123",
  "createdAt": "2026-04-25T12:34:56.789Z",
  "data": {
    "externalId": "PROD-123",
    "externalSystem": "shopify",
    "voopId": "uuid-internal",
    "sku": "ABC-001"
  }
}

header   = "t={timestamp},v1={hex_signature}"
payload  = `${timestamp}.${rawBody}`
signature = HMAC-SHA256(secret, payload)

import crypto from 'crypto';

function verifyVoopWebhook(req, secret) {
  const header = req.headers['x-voop-signature'];
  const [tPart, v1Part] = header.split(',');
  const timestamp = parseInt(tPart.split('=')[1], 10);
  const provided = v1Part.split('=')[1];

  // Replay protection: rejeitar se timestamp > 5 minutos
  if (Math.abs(Date.now() / 1000 - timestamp) > 300) {
    throw new Error('Webhook timestamp too old');
  }

  const rawBody = req.rawBody; // bytes brutos, antes do JSON.parse
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  // timing-safe compare!
  if (!crypto.timingSafeEqual(Buffer.from(provided), Buffer.from(expected))) {
    throw new Error('Invalid signature');
  }
}

attempt 1  →  imediato
attempt 2  →  ~5s
attempt 3  →  ~25s
attempt 4  →  ~2min
attempt 5  →  ~10min
attempt 6  →  ~30min
attempt 7  →  ~2h
attempt 8  →  ~6h
após 8     →  status="exhausted"