Webhooks

const crypto = require('crypto');

function verifyWebhook(payload, signature, timestamp, secret) {
  const message = `${timestamp}.${payload}`;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(message)
    .digest('hex');
  return `sha256=${expected}` === signature;
}

app.post('/webhooks/plaud', (req, res) => {
  const valid = verifyWebhook(
    JSON.stringify(req.body),
    req.headers['plaud-signature'],
    req.headers['plaud-timestamp'],
    process.env.PLAUD_WEBHOOK_SECRET
  );
  if (!valid) return res.status(401).send('Invalid signature');

  const { event, data } = req.body;
  if (event === 'transcription.completed') {
    console.log('Transcript ready:', data.transcriptionId);
  }
  res.sendStatus(200);
});