Zapier

https://hooks.zapier.com/hooks/catch/12345678/abcdefg/

const crypto = require('crypto');

const TOLERANCE_SECONDS = 300;

const rawBody = inputData.rawBody || '';
const signatureHeader = inputData.signatureHeader || '';
const deliveryId = inputData.deliveryId || '';
const eventType = inputData.eventType || '';
const secret = inputData.secret || '';

if (!secret) {
  throw new Error('Segreto webhook non configurato negli Input Data');
}

let timestamp = null;
const signatures = [];

for (const segment of signatureHeader.split(',')) {
  const index = segment.indexOf('=');
  if (index === -1) continue;
  const key = segment.slice(0, index).trim();
  const value = segment.slice(index + 1).trim();
  if (key === 't') timestamp = Number(value);
  if (key === 'v1') signatures.push(value);
}

function result(valid, reason, event) {
  return {
    valid,
    reason,
    deliveryId,
    eventType,
    eventId: event ? event.id : null,
    sessionId: event && event.data ? event.data.sessionId || '' : '',
    clientName:
      event && event.data && event.data.client
        ? event.data.client.displayName || ''
        : '',
    clientEmail:
      event && event.data && event.data.client ? event.data.client.email || '' : '',
    summary: event && event.data ? event.data.summary || '' : '',
    payload: event ? JSON.stringify(event) : '',
  };
}

if (!Number.isFinite(timestamp)) {
  return result(false, 'timestamp-non-valido', null);
}

const now = Math.floor(Date.now() / 1000);
if (Math.abs(now - timestamp) > TOLERANCE_SECONDS) {
  return result(false, 'timestamp-fuori-tolleranza', null);
}

if (signatures.length === 0) {
  return result(false, 'firma-assente', null);
}

const expected = crypto
  .createHmac('sha256', secret)
  .update(timestamp + '.' + rawBody, 'utf8')
  .digest('hex');

const expectedBuffer = Buffer.from(expected, 'utf8');
let valid = false;

for (const candidate of signatures) {
  const candidateBuffer = Buffer.from(candidate, 'utf8');
  if (
    candidateBuffer.length === expectedBuffer.length &&
    crypto.timingSafeEqual(candidateBuffer, expectedBuffer)
  ) {
    valid = true;
    break;
  }
}

if (!valid) {
  return result(false, 'firma-non-corrispondente', null);
}

const event = JSON.parse(rawBody);
return result(true, 'ok', event);

{"body": "Ticket aperto: {{5. Ticket Number}}", "visibility": "internal", "author": "zapier"}