import crypto from "node:crypto";

const SECRET = process.env.VITARELAY_WEBHOOK_SECRET!;

export async function POST(request: Request) {
  const rawBody = await request.text();
  const header = request.headers.get("X-VitaRelay-Signature");
  if (!header) return new Response("Missing signature", { status: 401 });

  const expected = crypto
    .createHmac("sha256", SECRET)
    .update(rawBody)
    .digest("hex");
  const received = header.replace(/^sha256=/, "");

  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(received, "hex");
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return new Response("Invalid signature", { status: 401 });
  }

  const deliveryId = request.headers.get("X-VitaRelay-Delivery")!;
  if (await alreadyProcessed(deliveryId)) {
    return new Response("OK", { status: 200 });
  }

  const event = JSON.parse(rawBody);
  await enqueue(deliveryId, event); // process async
  return new Response("OK", { status: 200 });
}

switch (event.event) {
  case "order.paid":
    await markPaid(event.order_id, event.total_cents);
    break;
  case "order.shipped":
  case "order.delivered":
    await setTracking(event.order_id, event.status, event.tracking_number);
    break;
  case "order.exception":
    await flagDeliveryProblem(event.order_id, event.tracking_status);
    break;
  case "intake.reviewed":
    await markRxSigned(event.escript_id, event.patient_id, event.signed_at);
    break;
}