curl -X POST https://api.engineapi.com.br/webhooks \
  -H "Authorization: Bearer SEU_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://seusite.com/webhooks/engine",
    "events": ["invoice.authorized", "invoice.rejected", "certificate.expiring_soon"],
    "secret": "meu-segredo-hmac"
  }'

import { createHmac, timingSafeEqual } from 'crypto';
import express from 'express';

const app = express();
app.use(express.raw({ type: 'application/json' }));

app.post('/webhooks/engine', (req, res) => {
  const signature = req.headers['x-engineapi-signature'] as string;
  const secret = process.env.WEBHOOK_SECRET!;

  // Calcular HMAC esperado
  const expected = 'sha256=' + createHmac('sha256', secret)
    .update(req.body)
    .digest('hex');

  // Comparação segura contra timing attacks
  const valid = timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );

  if (!valid) {
    return res.status(401).json({ error: 'Assinatura inválida' });
  }

  const { id, event, data } = JSON.parse(req.body.toString());
  
  // Processar evento
  handleEvent(id, event, data);
  
  res.status(200).json({ received: true });
});

app.post('/webhooks/engine', (req, res) => {
  // ... validação HMAC acima ...

  const { id, event, data } = JSON.parse(req.body.toString());
  
  // Idempotência: ignore eventos já processados
  if (await isAlreadyProcessed(id)) {
    return res.status(200).json({ received: true });
  }

  switch (event) {
    case 'invoice.authorized':
      await db.invoices.update({ 
        where: { id: data.id }, 
        data: { status: 'AUTHORIZED', accessKey: data.accessKey } 
      });
      await notifyCustomer(data.id);
      break;

    case 'invoice.rejected':
      await db.invoices.update({ 
        where: { id: data.id }, 
        data: { status: 'REJECTED' } 
      });
      await alertSupport(data);
      break;

    case 'certificate.expiring_soon':
      await sendEmail({
        to: 'admin@empresa.com',
        subject: '⚠️ Certificado digital vencendo em 30 dias',
        body: `Renove o certificado do CNPJ ${data.cnpj}`,
      });
      break;
  }

  await markAsProcessed(id);
  res.status(200).json({ received: true });
});