patient.created
encounter.updated
prescription.deleted

{
  "id": "evt_lx8f3a7x2_k9m2n4",
  "event": "patient.created",
  "timestamp": "2025-01-15T09:15:00.000Z",
  "data": {
    "resourceType": "patient",
    "resourceId": "pt_abc123",
    "action": "created",
    "tenantId": "org_def456",
    "environment": "live"
  }
}

import crypto from 'crypto';

const TOLERANCE_SECONDS = 300; // reject anything older than 5 minutes

function verifyWebhook(rawBody: string, header: string, secret: string): boolean {
  // header looks like: t=1700000000,v1=<hex>
  const parts = Object.fromEntries(
    header.split(',').map((kv) => kv.split('=', 2) as [string, string]),
  );
  const timestamp = Number(parts.t);
  const received = parts.v1 ?? '';
  if (!Number.isFinite(timestamp) || !received) return false;

  // Freshness — this is the part the timestamp buys you.
  if (Math.abs(Math.floor(Date.now() / 1000) - timestamp) > TOLERANCE_SECONDS) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  // timingSafeEqual THROWS when the two buffers differ in length, and the
  // signature is attacker-controlled — compare lengths first, or a malformed
  // header crashes your handler instead of returning 401.
  const a = Buffer.from(received, 'utf8');
  const b = Buffer.from(expected, 'utf8');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// In your webhook handler — note express.raw(), not express.json()
app.post('/webhooks/clinikapi', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.headers['x-clinik-signature-v2'] as string;
  const rawBody = req.body.toString('utf8');
  const isValid = header && verifyWebhook(rawBody, header, process.env.CLINIK_WEBHOOK_SECRET!);

  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(rawBody);
  switch (event.event) {
    case 'patient.created':
      // Handle new patient
      break;
    case 'appointment.updated':
      // Handle appointment change
      break;
  }

  res.status(200).send('OK');
});