Webhooks

@RestController
@RequestMapping("/webhooks/clickterm")
public class ClickTermWebhookController {

    private static final String TIMESTAMP_HEADER = "X-Clickterm-Timestamp";
    private static final String SIGNATURE_HEADER = "X-Clickterm-Signature";
    private static final long MAX_SKEW_SECONDS = 300L;

    @Value("${clickterm.webhook-secret}")
    private String webhookSecret;

    @PostMapping
    public ResponseEntity<Void> receiveWebhook(
        @RequestHeader(TIMESTAMP_HEADER) String timestamp,
        @RequestHeader(SIGNATURE_HEADER) String signature,
        @RequestBody byte[] rawBody
    ) throws Exception {
        long now = Instant.now().getEpochSecond();
        long requestTs = Long.parseLong(timestamp);

        if (Math.abs(now - requestTs) > MAX_SKEW_SECONDS) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
        }

        String signedPayload = timestamp + "." + new String(rawBody, StandardCharsets.UTF_8);

        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(
            webhookSecret.getBytes(StandardCharsets.UTF_8),
            "HmacSHA256"
        ));

        String digest = HexFormat.of().formatHex(
            mac.doFinal(signedPayload.getBytes(StandardCharsets.UTF_8))
        );
        // Important: prepend "sha256=" to match the header format
        String expected = "sha256=" + digest;

        if (!MessageDigest.isEqual(
            signature.getBytes(StandardCharsets.UTF_8),
            expected.getBytes(StandardCharsets.UTF_8)
        )) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
        }

        // Parse rawBody and process the event here.
        return ResponseEntity.ok().build();
    }
}