Developers

import express from 'express';
import crypto from 'crypto';

const app = express();
app.use(express.json());

const FORGE_WEBHOOK_SECRET = process.env.FORGE_WEBHOOK_SECRET;

app.post('/webhooks/forge-vote', (req, res) => {
    // 1. Verify the secret in the Authorization header
    const auth = req.headers.authorization;
    if (auth !== FORGE_WEBHOOK_SECRET) {
        return res.status(401).json({ error: 'Invalid secret' });
    }

    // 2. Parse the payload
    const { id, username, weeklyVotes, totalVotes, isTest } = req.body;

    // Skip test events in production handlers
    if (isTest) {
        console.log('Received test webhook for', username);
        return res.status(200).json({ ok: true });
    }

    // 3. Reward the user (example: grant a Discord role for 12h; role duration is intentionally longer than the 8h vote cooldown)
    grantVoterRole(id);

    // 4. Acknowledge within 5 seconds – non-2xx triggers retries (3 attempts)
    return res.status(200).json({ ok: true });
});

app.listen(3000, () => console.log('Webhook listener on :3000'));

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const secret = process.env.FORGE_WEBHOOK_SECRET;

app.post('/webhooks/forge', express.raw({ type: 'application/json' }), (req, res) => {
    const rawBody = req.body.toString('utf8');
    const received = req.header('X-Forge-Signature') || '';
    const expected = 'sha256=' + crypto
        .createHmac('sha256', secret)
        .update(rawBody)
        .digest('hex');

    const valid = received.length === expected.length &&
        crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));
    if (!valid) return res.status(401).json({ error: 'Invalid signature' });

    const event = JSON.parse(rawBody);
    console.log(event.type, event.id, event.data);
    return res.sendStatus(204);
});