curl -sS -X POST https://api.aideskbr.com/api/public/v1/webhooks \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/hooks/aidesk",
    "event_types": ["message.delivered", "message.read", "message.failed"]
  }'

{
  "event_type": "message.delivered",
  "event_id": "uuid-estavel-no-retry",
  "message_id": "uuid",
  "client_message_id": "seu-id",
  "delivery_state": "delivered",
  "channel_id": "uuid",
  "thread_id": "uuid",
  "contact_id": "uuid",
  "occurred_at": "2026-07-22T15:00:00.000Z",
  "sequence": 3
}

const crypto = require('crypto');

function verifyAideskWebhook(req, secret, { maxDriftSec = 300 } = {}) {
  const ts = Number(req.headers['x-aidesk-timestamp']);
  const sig = String(req.headers['x-aidesk-signature'] || '');
  if (!Number.isFinite(ts)) return false;
  if (Math.abs(Date.now() / 1000 - ts) > maxDriftSec) return false;

  const rawBody = req.rawBody; // Buffer/string bruto
  const expected =
    'sha256=' +
    crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  const a = Buffer.from(sig);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

app.use(express.json({
  verify: (req, res, buf) => {
    req.rawBody = buf;
  },
}));