Set Up Webhooks

import { Keypair } from '@solana/web3.js'; // Solana keypair for signing
import nacl from 'tweetnacl'; // Ed25519 signing library
import bs58 from 'bs58'; // Base58 encoding for Solana-compatible signatures

function createAuthHeaders(
  wallet: Keypair,
  method: string,
  path: string,
): Record<string, string> {
  const timestamp = Math.floor(Date.now() / 1000); // Unix timestamp in seconds
  const pubkey = wallet.publicKey.toBase58(); // Base58 wallet address
  const message = `vouch-auth:${pubkey}:${timestamp}:${method}:${path}`; // Canonical auth message format
  const msgBytes = new TextEncoder().encode(message); // Convert to bytes for signing
  const signature = nacl.sign.detached(msgBytes, wallet.secretKey); // Ed25519 detached signature

  return {
    'X-Wallet-Pubkey': pubkey, // Identifies the signing wallet
    'X-Wallet-Signature': bs58.encode(signature), // Proof of ownership
    'X-Wallet-Timestamp': timestamp.toString(), // Prevents replay attacks
  };
}

const headers = createAuthHeaders(wallet, 'POST', '/webhooks'); // Generate wallet auth headers

const res = await fetch('https://api.vouchprotocol.xyz/webhooks', { // Create a new webhook subscription
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    ...headers, // Spread the auth headers into the request
  },
  body: JSON.stringify({
    url: 'https://your-server.com/webhooks/vouch', // Your server's webhook endpoint
    eventTypes: [ // Subscribe to specific event types
      'agent.tier_updated',
      'agent.reputation_updated',
      'agent.status_changed',
    ],
    // Optional: filter events for a specific agent PDA
    // agentPda: 'AgentPDA...'
  }),
});

const webhook = await res.json();
console.log('Webhook ID:', webhook.id); // Unique subscription identifier
console.log('HMAC Secret:', webhook.secret); // Used to verify incoming payloads
// IMPORTANT: Save this secret! It is shown only once.

import { createHmac, timingSafeEqual } from 'crypto'; // Node crypto for HMAC verification

function verifyWebhookSignature(
  payload: string,    // Raw JSON body
  signature: string,  // X-Vouch-Signature header
  timestamp: string,  // X-Vouch-Timestamp header
  secret: string,     // Your stored webhook secret
): boolean {
  const signedContent = `${timestamp}.${payload}`; // Must match server's signing format
  const expected = createHmac('sha256', secret) // Compute HMAC using your webhook secret
    .update(signedContent)
    .digest('hex');

  const a = Buffer.from(signature); // Signature from X-Vouch-Signature header
  const b = Buffer.from(expected); // Our computed expected signature

  if (a.length !== b.length) return false; // Reject if lengths differ (prevents timing attacks)
  return timingSafeEqual(a, b); // Constant-time comparison to prevent timing side-channels
}

const headers = createAuthHeaders(wallet, 'GET', '/webhooks'); // Auth for listing subscriptions
const res = await fetch('https://api.vouchprotocol.xyz/webhooks', { headers }); // GET all your webhook subscriptions
const webhooks = await res.json();

const webhookId = 'wh_abc123'; // The webhook subscription ID to update
const headers = createAuthHeaders(wallet, 'PATCH', `/webhooks/${webhookId}`);

await fetch(`https://api.vouchprotocol.xyz/webhooks/${webhookId}`, { // PATCH to update event types
  method: 'PATCH',
  headers: { 'Content-Type': 'application/json', ...headers },
  body: JSON.stringify({
    eventTypes: ['agent.tier_updated', 'agent.registered'], // New set of subscribed events
  }),
});

const webhookId = 'wh_abc123'; // The webhook subscription ID to delete
const headers = createAuthHeaders(wallet, 'DELETE', `/webhooks/${webhookId}`);

const res = await fetch(`https://api.vouchprotocol.xyz/webhooks/${webhookId}`, { // DELETE to unsubscribe
  method: 'DELETE',
  headers,
});

const result = await res.json();
console.log('Deleted:', result.deleted); // true if the subscription was removed

const headers = createAuthHeaders(wallet, 'POST', `/webhooks/${webhookId}/rotate-secret`);
const res = await fetch( // Generate a new HMAC secret, invalidating the old one
  `https://api.vouchprotocol.xyz/webhooks/${webhookId}/rotate-secret`,
  { method: 'POST', headers },
);
const { secret } = await res.json(); // New secret — update your server config immediately
// Save the new secret!

const headers = createAuthHeaders(wallet, 'GET', `/webhooks/${webhookId}/deliveries`);
const res = await fetch( // Fetch delivery history to debug missed events
  `https://api.vouchprotocol.xyz/webhooks/${webhookId}/deliveries`,
  { headers },
);
const deliveries = await res.json(); // Contains status codes, timestamps, and retry info
console.log('Recent deliveries:', deliveries);