Webhooks

curl -X POST "https://api.arelpro.com/pro/api/v1/webhooks" \
  -H "Authorization: Bearer sk_live_VOTRE_CLE" \
  -H "X-Client-Id: VOTRE_CLIENT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://mon-site.fr/webhooks/arel",
    "events": ["shipping.assigned", "shipping.delivered"]
  }'

# Le secret est genere automatiquement et renvoye dans la reponse.
# Il reste lisible ensuite via GET /pro/api/v1/webhooks

{
  "event": "shipping.assigned",
  "timestamp": "2026-07-16T10:00:00.000Z",
  "data": {
    "id": "665f...",
    "professionalId": "664a...",
    "referenceNumber": "AREL-20260716-00042",
    "status": "assigned",
    "price": 9,
    "externalReference": { "platform": "api", "orderId": "CMD-1001" },
    "createdAt": "2026-07-16T10:00:00.000Z",
    "updatedAt": "2026-07-16T10:02:00.000Z",
    "pickupAddress": { },
    "deliveryAddress": {
      "recipientName": "Jean Dupont",
      "street": "123 Rue de la République",
      "city": "Paris",
      "postalCode": "75001",
      "country": "France",
      "phoneNumber": "+33612345678"
    },
    "deliverer": {
      "id": "6612a9f4c3b25d1e8a77f430",
      "name": null,
      "phoneNumber": null
    }
  }
}

const express = require('express');
const crypto = require('crypto');

const WEBHOOK_SECRET = 'votre_secret_webhook';
const app = express();

function verifyArelSignature(rawBody, timestamp, signature) {
  if (!timestamp || !signature) return false;

  // Le corps signe est : X-Arel-Timestamp + "." + corps brut
  const expected = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  const received = signature.startsWith('sha256=') ? signature.slice(7) : signature;
  const a = Buffer.from(expected);
  const b = Buffer.from(received);

  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

app.post(
  '/webhooks/arel',
  express.raw({ type: 'application/json' }), // corps brut obligatoire
  (req, res) => {
    const ok = verifyArelSignature(
      req.body.toString('utf8'),
      req.get('X-Arel-Timestamp'),
      req.get('X-Arel-Signature')
    );

    if (!ok) return res.sendStatus(401);

    // Repondez AVANT de traiter : le timeout est de 5 s, et un traitement
    // lent provoquerait un reessai, donc un doublon. L'accuse de reception
    // dit « signature valide, evenement recu », pas « traitement termine ».
    res.sendStatus(200);

    // Tout ce qui suit se fait apres la reponse, hors du chemin critique.
    let event;
    try {
      event = JSON.parse(req.body.toString('utf8'));
    } catch (err) {
      console.error('Corps illisible :', err);
      return;
    }

    // Dedupliquez sur data.id + event, JAMAIS sur la signature.
    if (event.event === 'shipping.created') {
      console.log('Bordereau cree :', event.data.referenceNumber);
    }
  }
);