const express = require('express');
const crypto  = require('crypto');
const app     = express();

app.post('/webhooks/github', express.raw({ type: 'application/json' }), (req, res) => {
  const sigHeader  = req.headers['x-hub-signature-256'];  // 'sha256=abc123...'
  const eventType  = req.headers['x-github-event'];       // 'push', 'pull_request', etc.

  if (!sigHeader) return res.status(400).send('Missing X-Hub-Signature-256');

  // Strip prefix and compare using timing-safe function
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.GITHUB_WEBHOOK_SECRET)
    .update(req.body)   // raw Buffer — must NOT parse JSON first
    .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(sigHeader), Buffer.from(expected))) {
    return res.status(401).send('Invalid signature');
  }

  const payload = JSON.parse(req.body);  // safe to parse now

  switch (eventType) {
    case 'ping':
      // Always handle ping — GitHub sends this when webhook is first created
      console.log('Webhook configured! Zen:', payload.zen);
      break;
    case 'push':
      const branch = payload.ref.replace('refs/heads/', '');
      console.log(`${payload.commits.length} commits pushed to ${branch}`);
      break;
    case 'pull_request':
      console.log(`PR #${payload.number} ${payload.action}: ${payload.pull_request.title}`);
      break;
    case 'release':
      console.log(`Release ${payload.release.tag_name} ${payload.action}`);
      break;
    default:
      console.log('Unhandled event:', eventType);
  }

  res.status(200).json({ received: true });
});