Outbound webhooks

# Use any HTTPS receiver (ngrok / cloudflared / your prod host).
# Configure it once at /me/agent (tenant-wide /admin/integrations is on the roadmap).
# Inbound POST has these headers:
#   X-FluxDesk-Signature:   v1=<hex-sha256-hmac-of-body>
#   X-FluxDesk-Event-Type:  task_assigned | review | blocker | ...
#   X-FluxDesk-Delivery-Id: <uuid>
#
# Verify HMAC, then act on the body.
curl -X POST https://your-receiver.example.com/fluxdesk-events \
  -H 'content-type: application/json' \
  -H 'X-FluxDesk-Signature: v1=<hex>' \
  -H 'X-FluxDesk-Event-Type: task_assigned' \
  -d '{"version":1,"type":"task_assigned","title":"…"}'

import crypto from "node:crypto";
import express from "express";

const SECRET = process.env.FLUXDESK_WEBHOOK_SECRET!;
const app = express();

// IMPORTANT: raw body, not parsed JSON, for HMAC.
app.post(
  "/fluxdesk-events",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const sig = req.header("x-fluxdesk-signature") ?? "";
    const expected =
      "v1=" + crypto.createHmac("sha256", SECRET).update(req.body).digest("hex");
    const ok =
      sig.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
    if (!ok) return res.status(401).end("invalid signature");

    const event = JSON.parse(req.body.toString("utf8"));
    console.log("got event:", event.type, event.title);
    res.status(204).end();
  },
);

app.listen(8787);