Webhooks

# Example webhook verification in Ruby
def verify_webhook_signature(request)
  signature = request.headers['X-Webhook-Signature']
  body = request.body.read

  expected_signature = "sha256=#{OpenSSL::HMAC.hexdigest('SHA256', webhook_secret, body)}"

  Rack::Utils.secure_compare(signature, expected_signature)
end

// Example webhook verification in Node.js
const crypto = require('crypto');

function verifyWebhookSignature(req, webhookSecret) {
  const signature = req.headers['x-webhook-signature'];
  const body = JSON.stringify(req.body);

  const expectedSignature = 'sha256=' + crypto
    .createHmac('sha256', webhookSecret)
    .update(body)
    .digest('hex');

  return signature === expectedSignature;
}

# Ruby/Rails example
class WebhooksController < ApplicationController
  skip_before_action :verify_authenticity_token

  def handle
    # Verify the webhook signature
    unless verify_webhook_signature(request)
      head :unauthorized
      return
    end

    # Parse the webhook payload
    event = JSON.parse(request.body.read)

    # Process the webhook asynchronously
    ProcessWebhookJob.perform_later(event)

    # Respond immediately
    head :ok
  end

  private

  def verify_webhook_signature(request)
    signature = request.headers['X-Webhook-Signature']
    body = request.body.read
    request.body.rewind # Reset for re-reading

    expected = "sha256=#{OpenSSL::HMAC.hexdigest('SHA256', ENV['SCHOLARLY_WEBHOOK_SECRET'], body)}"

    Rack::Utils.secure_compare(signature, expected)
  end
end

// Node.js/Express example
const express = require('express');
const crypto = require('crypto');

app.post('/webhooks', express.raw({type: 'application/json'}), (req, res) => {
  // Verify the webhook signature
  const signature = req.headers['x-webhook-signature'];
  const expectedSignature = 'sha256=' + crypto
    .createHmac('sha256', process.env.SCHOLARLY_WEBHOOK_SECRET)
    .update(req.body)
    .digest('hex');

  if (signature !== expectedSignature) {
    return res.status(401).send('Unauthorized');
  }

  // Parse the webhook payload
  const event = JSON.parse(req.body);

  // Process the webhook asynchronously
  processWebhook(event);

  // Respond immediately
  res.status(200).send('OK');
});

async function processWebhook(event) {
  switch(event.type) {
    case 'department.created':
      // Handle department creation
      const departmentId = event.data.id;
      // Fetch full department data from API if needed
      break;
    case 'profile.created':
    case 'profile.updated':
    case 'profile.deleted':
      // Handle profile events (created, updated, deleted)
      const profileId = event.data.id;
      // Note: profile.updated includes avatar changes
      // Fetch full profile data from API if needed
      break;
    case 'primary_appointment.created':
    case 'primary_appointment.updated':
    case 'primary_appointment.deleted':
      // Handle primary appointment events (created, updated, deleted)
      const primaryAppointmentId = event.data.id;
      // Fetch full primary appointment data from API if needed
      break;
    case 'additional_appointment.created':
    case 'additional_appointment.updated':
    case 'additional_appointment.deleted':
      // Handle secondary appointment events (created, updated, deleted)
      const secondaryAppointmentId = event.data.id;
      // Fetch full secondary appointment data from API if needed
      break;
    case 'user.created':
    case 'user.updated':
    case 'user.deleted':
      // Handle user events (created, updated, deleted)
      const userId = event.data.id;
      // Note: user.updated includes changes to the user's custom fields
      // Fetch full user data from API if needed
      break;
    // Handle other event types...
  }
}