n8n

const crypto = require('crypto');

const TOLERANCE_SECONDS = 300;

const secrets = [
  $env.BP_WEBHOOK_SECRET,
  $env.BP_WEBHOOK_SECRET_NEXT,
].filter(Boolean);

if (secrets.length === 0) {
  throw new Error('Nessun segreto webhook configurato nelle variabili d ambiente');
}

const item = $input.first();
const headers = item.json.headers ?? {};

// Con Raw Body attivo il corpo arriva in Base64 nella proprietà binaria.
const rawBody = Buffer.from(item.binary.data.data, 'base64').toString('utf8');

const signatureHeader = headers['x-bp-signature'] ?? '';
const deliveryId = headers['x-bp-delivery'] ?? '';
const eventType = headers['x-bp-event'] ?? '';

let timestamp = null;
const signatures = [];

for (const segment of signatureHeader.split(',')) {
  const index = segment.indexOf('=');
  if (index === -1) continue;
  const key = segment.slice(0, index).trim();
  const value = segment.slice(index + 1).trim();
  if (key === 't') timestamp = Number(value);
  if (key === 'v1') signatures.push(value);
}

function fail(reason, status) {
  return [
    {
      json: {
        valid: false,
        reason,
        status,
        deliveryId,
        eventType,
      },
    },
  ];
}

if (!Number.isFinite(timestamp)) {
  return fail('timestamp-non-valido', 400);
}

const now = Math.floor(Date.now() / 1000);
if (Math.abs(now - timestamp) > TOLERANCE_SECONDS) {
  return fail('timestamp-fuori-tolleranza', 400);
}

if (signatures.length === 0) {
  return fail('firma-assente', 401);
}

const signedPayload = `${timestamp}.${rawBody}`;
let valid = false;

for (const secret of secrets) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(signedPayload, 'utf8')
    .digest('hex');
  const expectedBuffer = Buffer.from(expected, 'utf8');

  for (const candidate of signatures) {
    const candidateBuffer = Buffer.from(candidate, 'utf8');
    if (
      candidateBuffer.length === expectedBuffer.length &&
      crypto.timingSafeEqual(candidateBuffer, expectedBuffer)
    ) {
      valid = true;
      break;
    }
  }
  if (valid) break;
}

if (!valid) {
  return fail('firma-non-corrispondente', 401);
}

const event = JSON.parse(rawBody);

return [
  {
    json: {
      valid: true,
      reason: 'ok',
      status: 202,
      deliveryId,
      eventType,
      event,
    },
  },
];

{
  "body": "Ticket aperto nel gestionale: {{ $json.numeroPratica }}",
  "visibility": "internal",
  "author": "n8n"
}

{
  "name": "BluPantheon - Ricezione eventi",
  "nodes": [
    {
      "parameters": {
        "httpMethod": "POST",
        "path": "blupantheon",
        "responseMode": "responseNode",
        "options": {
          "rawBody": true,
          "binaryPropertyName": "data"
        }
      },
      "id": "a1000000-0000-4000-8000-000000000001",
      "name": "Webhook",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [-200, 300],
      "webhookId": "a1000000-0000-4000-8000-000000000001"
    },
    {
      "parameters": {
        "mode": "runOnceForAllItems",
        "jsCode": "const crypto = require('crypto');\nconst TOLERANCE_SECONDS = 300;\nconst secrets = [$env.BP_WEBHOOK_SECRET, $env.BP_WEBHOOK_SECRET_NEXT].filter(Boolean);\nif (secrets.length === 0) { throw new Error('Nessun segreto webhook configurato'); }\nconst item = $input.first();\nconst headers = item.json.headers || {};\nconst rawBody = Buffer.from(item.binary.data.data, 'base64').toString('utf8');\nconst signatureHeader = headers['x-bp-signature'] || '';\nconst deliveryId = headers['x-bp-delivery'] || '';\nconst eventType = headers['x-bp-event'] || '';\nlet timestamp = null;\nconst signatures = [];\nfor (const segment of signatureHeader.split(',')) {\n  const index = segment.indexOf('=');\n  if (index === -1) continue;\n  const key = segment.slice(0, index).trim();\n  const value = segment.slice(index + 1).trim();\n  if (key === 't') timestamp = Number(value);\n  if (key === 'v1') signatures.push(value);\n}\nfunction fail(reason, status) { return [{ json: { valid: false, reason, status, deliveryId, eventType } }]; }\nif (!Number.isFinite(timestamp)) return fail('timestamp-non-valido', 400);\nconst now = Math.floor(Date.now() / 1000);\nif (Math.abs(now - timestamp) > TOLERANCE_SECONDS) return fail('timestamp-fuori-tolleranza', 400);\nif (signatures.length === 0) return fail('firma-assente', 401);\nconst signedPayload = timestamp + '.' + rawBody;\nlet valid = false;\nfor (const secret of secrets) {\n  const expected = crypto.createHmac('sha256', secret).update(signedPayload, 'utf8').digest('hex');\n  const expectedBuffer = Buffer.from(expected, 'utf8');\n  for (const candidate of signatures) {\n    const candidateBuffer = Buffer.from(candidate, 'utf8');\n    if (candidateBuffer.length === expectedBuffer.length && crypto.timingSafeEqual(candidateBuffer, expectedBuffer)) { valid = true; break; }\n  }\n  if (valid) break;\n}\nif (!valid) return fail('firma-non-corrispondente', 401);\nconst event = JSON.parse(rawBody);\nreturn [{ json: { valid: true, reason: 'ok', status: 202, deliveryId, eventType, event } }];"
      },
      "id": "a1000000-0000-4000-8000-000000000002",
      "name": "Verifica firma",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [20, 300]
    },
    {
      "parameters": {
        "conditions": {
          "options": { "caseSensitive": true, "version": 2 },
          "conditions": [
            {
              "id": "cond-1",
              "leftValue": "={{ $json.valid }}",
              "rightValue": true,
              "operator": { "type": "boolean", "operation": "true", "singleValue": true }
            }
          ],
          "combinator": "and"
        },
        "options": {}
      },
      "id": "a1000000-0000-4000-8000-000000000003",
      "name": "Firma valida?",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2,
      "position": [240, 300]
    },
    {
      "parameters": {
        "respondWith": "json",
        "responseBody": "={{ JSON.stringify({ status: 'accettato' }) }}",
        "options": { "responseCode": 202 }
      },
      "id": "a1000000-0000-4000-8000-000000000004",
      "name": "Accetta",
      "type": "n8n-nodes-base.respondToWebhook",
      "typeVersion": 1,
      "position": [460, 200]
    },
    {
      "parameters": {
        "respondWith": "json",
        "responseBody": "={{ JSON.stringify({ error: $json.reason }) }}",
        "options": { "responseCode": "={{ $json.status }}" }
      },
      "id": "a1000000-0000-4000-8000-000000000005",
      "name": "Rifiuta",
      "type": "n8n-nodes-base.respondToWebhook",
      "typeVersion": 1,
      "position": [460, 420]
    },
    {
      "parameters": {
        "method": "POST",
        "url": "=https://api.blupantheon.com/identity/v1/sessions/{{ $json.event.data.sessionId }}/notes",
        "authentication": "genericCredentialType",
        "genericAuthType": "httpHeaderAuth",
        "sendHeaders": true,
        "headerParameters": {
          "parameters": [
            { "name": "X-BP-Project", "value": "={{ $env.BP_PROJECT_ID }}" },
            { "name": "Idempotency-Key", "value": "={{ $json.deliveryId }}" }
          ]
        },
        "sendBody": true,
        "specifyBody": "json",
        "jsonBody": "={{ JSON.stringify({ body: 'Evento ricevuto: ' + $json.eventType, visibility: 'internal', author: 'n8n' }) }}",
        "options": { "timeout": 15000 }
      },
      "id": "a1000000-0000-4000-8000-000000000006",
      "name": "Aggiungi nota sessione",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
      "position": [700, 200],
      "retryOnFail": true,
      "maxTries": 3,
      "waitBetweenTries": 2000
    }
  ],
  "connections": {
    "Webhook": { "main": [[{ "node": "Verifica firma", "type": "main", "index": 0 }]] },
    "Verifica firma": { "main": [[{ "node": "Firma valida?", "type": "main", "index": 0 }]] },
    "Firma valida?": {
      "main": [
        [{ "node": "Accetta", "type": "main", "index": 0 }],
        [{ "node": "Rifiuta", "type": "main", "index": 0 }]
      ]
    },
    "Accetta": {
      "main": [[{ "node": "Aggiungi nota sessione", "type": "main", "index": 0 }]]
    }
  },
  "settings": { "executionOrder": "v1" },
  "active": false
}