Webhooks and triggers

# Send a webhook when customer_42 gets a new email.
curl https://setu.supremeai.services/api/setu/v1/trigger-subscriptions \
  -H "Authorization: Bearer $SETU_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "trigger": "GMAIL_NEW_EMAIL", "userId": "customer_42" }'

import { createHmac, timingSafeEqual } from 'node:crypto';

// Check the raw body before you parse it.
export function isFromSetu(rawBody: string, timestamp: string, signature: string, secret: string) {
  if (!signature.startsWith('v1=')) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false; // 5-minute window
  const expected = createHmac('sha256', secret).update(`${timestamp}.${rawBody}`).digest('hex');
  const given = signature.slice(3);
  return given.length === expected.length && timingSafeEqual(Buffer.from(given), Buffer.from(expected));
}

// timestamp = request header "x-supreme-timestamp", signature = "x-supreme-signature"