Recall alerts with webhooks

# 1. Register your HTTPS address. The answer includes the signing secret, shown only once.
curl -X POST https://recalldb.app/v1/webhooks \
  -H "Authorization: Bearer $RECALLDB_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/recalls"}'

# 2. Watch some makes and brands (a free key: 1 watchlist of up to 10 values). Use the webhook id from step 1.
curl -X POST https://recalldb.app/v1/watchlists \
  -H "Authorization: Bearer $RECALLDB_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Our fleet and brands", "makes": ["Ford", "Toyota"], "brands": ["Graco"], "webhook_id": "wh_REPLACE_ME"}'

# 3. Ask for a test message, then look at the delivery log.
curl -X POST https://recalldb.app/v1/webhooks/wh_REPLACE_ME/test -H "Authorization: Bearer $RECALLDB_KEY"
curl https://recalldb.app/v1/webhooks/wh_REPLACE_ME/deliveries -H "Authorization: Bearer $RECALLDB_KEY"

// A minimal receiver for RecallDB webhooks that checks the signature before trusting a message.
//   WEBHOOK_SECRET=whsec_... node webhook-receiver.mjs      (listens on port 8787; put it behind HTTPS)
import { createHmac, timingSafeEqual } from 'node:crypto'
import { createServer } from 'node:http'

const SECRET = process.env.WEBHOOK_SECRET
const TOLERANCE_SECONDS = 300 // refuse messages older than 5 minutes (replays)

export function verify(rawBody, header, secret, now = Date.now()) {
  // X-RecallDB-Signature looks like: t=1763035200,v1=<hex HMAC-SHA256 of "<t>.<raw body>">
  const parts = Object.fromEntries((header ?? '').split(',').map((p) => p.split('=')))
  const t = Number(parts.t)
  if (!t || !parts.v1 || Math.abs(now / 1000 - t) > TOLERANCE_SECONDS) return false
  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex')
  return expected.length === parts.v1.length && timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1))
}

if (process.argv[1]?.endsWith('webhook-receiver.mjs')) {
  createServer((req, res) => {
    let raw = ''
    req.on('data', (chunk) => (raw += chunk))
    req.on('end', () => {
      if (!verify(raw, req.headers['x-recalldb-signature'], SECRET)) {
        res.writeHead(401).end('bad signature')
        return
      }
      const event = JSON.parse(raw)
      if (event.type === 'test') console.log('Test message received:', event.id)
      else {
        const { recall, matched } = event.data
        console.log(`${event.type}: ${recall.title} (${recall.source.agency} ${recall.source.official_id})`)
        console.log(`  matched: ${matched.flatMap((m) => m.terms.map((t) => `${t.kind} ${t.value}`)).join(', ')}`)
        console.log(`  official notice: ${recall.source.official_url}`)
      }
      res.writeHead(200).end('ok') // answer 2xx quickly; slow work belongs in a queue
    })
  }).listen(8787, () => console.log('Listening on http://localhost:8787'))
}