Segurança

async function verifySignature(
  body: string,
  signatureHeader: string,
  secret: string,
): Promise<boolean> {
  if (!signatureHeader.startsWith('sha256=')) return false

  const expectedHex = signatureHeader.slice(7)
  if (expectedHex.length % 2 !== 0) return false // hex truncado = inválido

  const encoder = new TextEncoder()
  const key = await crypto.subtle.importKey(
    'raw',
    encoder.encode(secret),
    { name: 'HMAC', hash: 'SHA-256' },
    false,
    ['verify'],
  )

  const expectedBytes = new Uint8Array(expectedHex.length / 2)
  for (let i = 0; i < expectedHex.length; i += 2) {
    expectedBytes[i / 2] = parseInt(expectedHex.slice(i, i + 2), 16)
  }

  return crypto.subtle.verify('HMAC', key, expectedBytes, encoder.encode(body))
}

export async function POST(request: Request): Promise<Response> {
  // 1. Ler o body como texto — ANTES de qualquer parse
  const body = await request.text()
  const signature = request.headers.get('x-coexy-signature') ?? ''

  // 2. Verificar assinatura — rejeitar imediatamente se inválida
  const valid = await verifySignature(body, signature, process.env.COEXY_HMAC_SECRET!)
  if (!valid) return new Response('Unauthorized', { status: 401 })

  const event = JSON.parse(body)

  // 3. Responder 200 ANTES de processar (veja seção abaixo)
  processEvent(event).catch(console.error)
  return new Response('OK', { status: 200 })
}

// ✅ Correto — responde antes de processar
processEvent(event).catch(console.error)
return new Response('OK', { status: 200 })

// ❌ Errado — bloqueia até o processamento terminar
await processEvent(event)
return new Response('OK', { status: 200 })

-- Nunca falha em duplicatas
INSERT INTO messages (wamid, channel_id, from_number, body, received_at)
VALUES ($1, $2, $3, $4, $5)
ON CONFLICT (wamid) DO NOTHING;

// Supabase JS — equivalente
await supabase
  .from('messages')
  .upsert({ wamid, channel_id, from_number, body, received_at }, { onConflict: 'wamid', ignoreDuplicates: true })