Build a durable webhook receiver

CREATE TABLE webhook_inbox (
  receiver_key text NOT NULL,
  event_id text NOT NULL,
  payload jsonb NOT NULL,
  received_at timestamptz NOT NULL DEFAULT now(),
  processed_at timestamptz,
  PRIMARY KEY (receiver_key, event_id)
);

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyOutgoing(rawBody, header, secret, now = Date.now()) {
  if (!Buffer.isBuffer(rawBody) || typeof header !== 'string') return false;
  const match = /^t=(\d+),v1=([a-f0-9]{64})$/.exec(header);
  if (!match) return false;
  const timestamp = Number(match[1]);
  if (!Number.isSafeInteger(timestamp) || timestamp <= 0) return false;
  if (Math.abs(Math.floor(now / 1000) - timestamp) > 300) return false;
  const expected = createHmac('sha256', secret)
    .update(match[1] + '.')
    .update(rawBody)
    .digest();
  const received = Buffer.from(match[2], 'hex');
  return received.length === expected.length && timingSafeEqual(received, expected);
}

// Express example. Mount this route BEFORE a global JSON parser.
// db is your PostgreSQL client. Import verifyOutgoing from the example above.
app.post('/webhooks/message', express.raw({ type: 'application/json' }), async (req, res) => {
  if (!verifyOutgoing(req.body, req.get('x-message-signature'), process.env.MESSAGE_WEBHOOK_SECRET)) {
    return res.sendStatus(401);
  }
  let event;
  try { event = JSON.parse(req.body.toString('utf8')); }
  catch { return res.sendStatus(400); }
  if (!event || typeof event.eventId !== 'string' || !event.eventId || typeof event.topic !== 'string') {
    return res.sendStatus(400);
  }
  try {
    // Store the payload, not only a 'seen' flag. A worker processes pending rows.
    // receiver_key scopes deduplication to this logical consumer.
    await db.query(
      'INSERT INTO webhook_inbox (receiver_key, event_id, payload) VALUES ($1, $2, $3::jsonb) ON CONFLICT DO NOTHING',
      ['message-primary', event.eventId, JSON.stringify(event)]
    );
    // Only acknowledge after the database commits the insert.
    return res.sendStatus(200);
  } catch {
    return res.sendStatus(503); // safe for Message to retry
  }
});