{
  "id": "evt_msaygdno_y4n1ox",
  "event": "appointment.created",
  "timestamp": "2026-08-02T09:15:00.000Z",
  "data": {
    "resourceType": "appointment",
    "resourceId": "b79ea396-6161-4f8b-9004-5ba29d9f3744",
    "action": "created",
    "tenantId": "6ed948b8-7fe0-48e4-9521-0606cdab7cd4",
    "environment": "live"
  }
}

import crypto from 'crypto';

const TOLERANCE_SECONDS = 300;

export async function POST(req: Request) {
  // 1. VERIFY — against the RAW body. Re-serializing parsed JSON changes the
  //    bytes and the signature will never match.
  const raw = await req.text();
  if (!verify(raw, req.headers.get('x-clinik-signature-v2'), process.env.CLINIK_WEBHOOK_SECRET!)) {
    return new Response('invalid signature', { status: 401 });
  }

  const { id, event, data } = JSON.parse(raw);

  // 2. DEDUPLICATE — delivery is at-least-once, so this event can legitimately
  //    arrive more than once. Without this, a retry sends a second reminder.
  if (await seen(id)) return new Response('ok');
  await remember(id);

  // 3. ENVIRONMENT — one endpoint receives sandbox and production events alike.
  //    Skip anything that is not real before it can trigger real work.
  if (data.environment !== 'live') return new Response('ok');

  // 4. FETCH — the payload has ids, not data.
  if (event === 'appointment.created') {
    const { data: appt } = await clinik.appointments.read(data.resourceId);
    const { data: patient } = await clinik.patients.read(appt.patientId);

    // 5. ACT — but queue it. Slow handlers get retried.
    await queue.publish('reminder', { to: patient.phone, at: appt.start });
  }

  return new Response('ok');
}

function verify(rawBody: string, header: string | null, secret: string): boolean {
  if (!header) return false;
  const parts = Object.fromEntries(header.split(',').map((kv) => kv.split('=', 2)));
  const timestamp = Number(parts.t);
  const received = parts.v1 ?? '';
  if (!Number.isFinite(timestamp) || !received) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - timestamp) > TOLERANCE_SECONDS) return false;

  const expected = crypto.createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`).digest('hex');

  // timingSafeEqual THROWS on a length mismatch, and the signature is
  // attacker-controlled — compare lengths first or a junk header crashes you.
  const a = Buffer.from(received, 'utf8');
  const b = Buffer.from(expected, 'utf8');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

if (event === 'lab.created') {
  const { data: report } = await clinik.labs.read(data.resourceId);
  if (isCritical(report)) await page(onCallFor(report.patientId), report);
}