Make

Blu Pantheon ──► Gateway (Cloudflare Worker) ──► Custom webhook Make
                 verifica HMAC + 202                elabora

export default {
  async fetch(request, env) {
    if (request.method !== 'POST') {
      return new Response('Metodo non consentito', { status: 405 });
    }

    const rawBody = await request.text();
    const signatureHeader = request.headers.get('X-BP-Signature') ?? '';
    const deliveryId = request.headers.get('X-BP-Delivery') ?? '';
    const eventType = request.headers.get('X-BP-Event') ?? '';

    let timestamp = null;
    const signatures = [];

    for (const segment of signatureHeader.split(',')) {
      const index = segment.indexOf('=');
      if (index === -1) continue;
      const key = segment.slice(0, index).trim();
      const value = segment.slice(index + 1).trim();
      if (key === 't') timestamp = Number(value);
      if (key === 'v1') signatures.push(value);
    }

    if (!Number.isFinite(timestamp)) {
      return new Response('timestamp non valido', { status: 400 });
    }

    const now = Math.floor(Date.now() / 1000);
    if (Math.abs(now - timestamp) > 300) {
      return new Response('timestamp fuori tolleranza', { status: 400 });
    }

    const key = await crypto.subtle.importKey(
      'raw',
      new TextEncoder().encode(env.BP_WEBHOOK_SECRET),
      { name: 'HMAC', hash: 'SHA-256' },
      false,
      ['sign'],
    );

    const signatureBytes = await crypto.subtle.sign(
      'HMAC',
      key,
      new TextEncoder().encode(`${timestamp}.${rawBody}`),
    );

    const expected = [...new Uint8Array(signatureBytes)]
      .map((byte) => byte.toString(16).padStart(2, '0'))
      .join('');

    const valid = signatures.some((candidate) => {
      if (candidate.length !== expected.length) return false;
      let diff = 0;
      for (let i = 0; i < candidate.length; i += 1) {
        diff |= candidate.charCodeAt(i) ^ expected.charCodeAt(i);
      }
      return diff === 0;
    });

    if (!valid) {
      return new Response('firma non valida', { status: 401 });
    }

    // Inoltro a Make senza attendere la risposta dello scenario.
    const forward = fetch(env.MAKE_WEBHOOK_URL, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-BP-Delivery': deliveryId,
        'X-BP-Event': eventType,
      },
      body: rawBody,
    });

    request.waitUntil?.(forward);
    return new Response(JSON.stringify({ status: 'accettato' }), {
      status: 202,
      headers: { 'Content-Type': 'application/json' },
    });
  },
};

{
  "body": "Pratica creata nel gestionale: {{5.numeroPratica}}",
  "visibility": "internal",
  "author": "make"
}