Webhooks

const crypto = require("crypto");

const SIGNATURE_TOLERANCE_SECONDS = 5 * 60;

function verifyMessariSignature(rawBody, header, secret) {
  if (!header) return false;

  const parts = {};
  for (const part of header.split(",")) {
    const [k, v] = part.split("=");
    if (k && v) parts[k.trim()] = v.trim();
  }

  const timestamp = parts.t;
  const provided = parts.v1;
  if (!timestamp || !provided || !/^[a-f0-9]{64}$/i.test(provided)) {
    return false;
  }

  const age = Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp));
  if (!Number.isFinite(age) || age > SIGNATURE_TOLERANCE_SECONDS) {
    return false;
  }

  const signedPayload = `${timestamp}.${rawBody}`;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(signedPayload)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(provided, "hex"),
  );
}

const express = require("express");
const app = express();

const SECRET = process.env.MESSARI_WEBHOOK_SECRET;

// Capture the raw body so signature verification matches exactly what was signed
app.post(
  "/messari/webhook",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.header("X-Webhook-Signature") ?? "";
    if (!verifyMessariSignature(req.body, signature, SECRET)) {
      return res.status(401).send("invalid signature");
    }

    const envelope = JSON.parse(req.body.toString("utf8"));

    // Ack immediately — process in the background
    res.status(200).send("ok");
    setImmediate(() => forwardToLinear(envelope).catch(console.error));
  }
);

app.listen(3000);

const LINEAR_API_KEY = process.env.LINEAR_API_KEY;
const LINEAR_TEAM_ID = process.env.LINEAR_TEAM_ID;

// Linear priority enum: 0 none, 1 urgent, 2 high, 3 medium, 4 low
const PRIORITY = { high: 2, medium: 3, low: 4 };

async function forwardToLinear(envelope) {
  if (envelope.type !== "monitoring_event") return;

  const { view, latest_development: dev, assets = [] } = envelope.data;
  const assetList = assets.map((a) => a.name).join(", ") || "—";

  const input = {
    teamId: LINEAR_TEAM_ID,
    title: `[${view.name}] ${dev.title}`,
    description: [
      `**View:** ${view.name}`,
      `**Assets:** ${assetList}`,
      `**Detected:** ${dev.created_at}`,
      "",
      dev.summary,
    ].join("\n"),
    priority: PRIORITY[dev.importance] ?? 0,
  };

  const res = await fetch("https://api.linear.app/graphql", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Authorization: LINEAR_API_KEY,
    },
    body: JSON.stringify({
      query: `mutation($input: IssueCreateInput!) {
        issueCreate(input: $input) { success issue { identifier url } }
      }`,
      variables: { input },
    }),
  });

  if (!res.ok) throw new Error(`Linear ${res.status}: ${await res.text()}`);
}