Implémentation

import express from "express";
import crypto from "node:crypto";

const SIGNING_SECRET = process.env.LECOMMIS_SIGNING_SECRET;
const TOLERANCE = 5 * 60;
const app = express();

app.post(
  "/webhooks/lecommis",
  express.raw({ type: "application/json" }),
  async (req, res) => {
    const rawBody = req.body; // Buffer brut
    const signature = req.get("X-LeCommis-Signature") || "";
    const timestamp = req.get("X-LeCommis-Timestamp") || "";
    const delivery = req.get("X-LeCommis-Delivery") || "";

    // 1. Anti-rejeu + signature.
    if (Math.abs(Date.now() / 1000 - Number(timestamp)) > TOLERANCE) {
      return res.status(401).send("stale");
    }
    const digest = crypto
      .createHmac("sha256", SIGNING_SECRET)
      .update(`${timestamp}.${rawBody.toString("utf8")}`)
      .digest("hex");
    const expected = `sha256=${digest}`;
    const ok =
      expected.length === signature.length &&
      crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
    if (!ok) return res.status(401).send("invalid signature");

    const payload = JSON.parse(rawBody.toString("utf8"));

    // 2 + 3. Répondre vite, traiter en async (après dédup).
    if (!(await alreadyProcessed(delivery))) {
      await queue.add("process-lecommis-webhook", payload);
    }
    res.status(200).send("ok");
  }
);

// 4 + 5 — exécuté par le worker.
async function handle(payload) {
  const { establishment_slug: slug, changed_resources } = payload.data;

  for (const resource of changed_resources) {
    if (resource === "profile") await refetch(`/establishments/${slug}`);
    else if (resource === "business_hours" || resource === "special_hours")
      await refetch(`/establishments/${slug}/hours`);
    else if (resource === "menus" || resource === "master_menu")
      await refetch(`/establishments/${slug}/menus`);
  }

  await purgeCache(slug); // invalider votre cache
  await triggerRebuild(slug); // ou déclencher un build
}