// Node.js — Verify NiraPay webhook signature
import crypto from 'crypto';

app.post('/webhook', (req, res) => {
  const signature = req.headers['x-nirapay-signature'];
  const payload   = JSON.stringify(req.body);

  const expected = crypto
    .createHmac('sha256', process.env.NIRAPAY_WEBHOOK_SECRET)
    .update(payload)
    .digest('hex');

  if (signature !== expected) {
    return res.status(401).send('Invalid signature');
  }

  const { event, data } = req.body;

  if (event === 'payment_confirmed') {
    // fulfil the order
    fulfillOrder(data.order_id);
  }

  res.status(200).send('OK');
});