Receiving webhooks

const express = require("express")
const { Pool } = require("pg")

const { verifyGemifierSignature } = require("./gemifier-signature")

const app = express()
const pool = new Pool()
const secret = process.env.GEMIFIER_WEBHOOK_SECRET // whsec_...

// Gemifier signs and sends the timestamp but enforces no freshness window, so
// this number is yours. It is stamped per attempt, not per event, so it only
// has to cover clock skew and time in flight.
const TOLERANCE_SECONDS = 300

app.post(
  "/gemifier",
  express.raw({ type: "application/json" }),
  async (request, response) => {
    const timestamp = request.get("X-Gemifier-Timestamp")
    const signature = request.get("X-Gemifier-Signature")
    const deliveryId = request.get("X-Gemifier-Delivery")

    if (!verifyGemifierSignature(request.body, timestamp, signature, secret)) {
      // Forged or misconfigured. 401 is permanent, which is correct: a
      // byte-identical retry would fail the same way.
      return response.sendStatus(401)
    }

    if (Math.abs(Date.now() / 1000 - Number(timestamp)) > TOLERANCE_SECONDS) {
      return response.sendStatus(401)
    }

    const envelope = JSON.parse(request.body.toString("utf8"))

    if (envelope.version !== 1) {
      // A shape you were not built for. Say you are not ready rather than
      // refusing permanently.
      return response.sendStatus(503)
    }

    // The delivery id is stable across every retry of one occasion and
    // different between two occasions. A unique constraint on it is what makes
    // this insert idempotent.
    const claimed = await pool.query(
      `INSERT INTO gemifier_deliveries (delivery_id, event, occurred_at_utc, payload)
       VALUES ($1, $2, $3, $4)
       ON CONFLICT (delivery_id) DO NOTHING
       RETURNING delivery_id`,
      [deliveryId, envelope.event, envelope.occurredAtUtc, envelope.data],
    )

    if (claimed.rowCount === 0) {
      // Already accepted. Answering 2xx again is what stops the retries.
      return response.sendStatus(200)
    }

    return response.sendStatus(202)
  },
)

app.listen(3000)

CREATE TABLE gemifier_deliveries (
  delivery_id      uuid PRIMARY KEY,
  event            text        NOT NULL,
  occurred_at_utc  timestamptz NOT NULL,
  payload          jsonb       NOT NULL,
  processed_at     timestamptz
);

async function processOne(row) {
  switch (row.event) {
    case "catalog_item.fulfillment_requested":
      // The instruction. row.payload.value is ABSENT, not null, when the
      // catalog item carries no value, so read it defensively.
      await fulfil({
        playerId: row.payload.playerExternalId,
        item: row.payload.catalogItemKey,
        valueType: row.payload.valueType, // "Number" | "String" | "Boolean"
        value: row.payload.value,
        idempotencyKey: row.delivery_id,
      })
      break

    case "mission.completed":
      // A notification. Carries no amounts, so there is nothing to credit.
      // occurrenceNumber counts from 0: a one-time mission always sends 0.
      await recordCompletion(
        row.payload.playerExternalId,
        row.payload.missionKey,
        row.payload.occurrenceNumber + 1,
      )
      break

    case "streak.milestone_reached":
      await recordMilestone(
        row.payload.playerExternalId,
        row.payload.streakKey,
        row.payload.threshold,
      )
      break

    default:
      // "ping", or an event type added after you deployed. Both are fine.
      break
  }

  await markProcessed(row.delivery_id)
}

curl -X POST https://api.gemifier.io/v1/missions \
  -H "Authorization: Bearer gem_sbox_..." \
  -H "Content-Type: application/json" \
  -d '{ "playerId": "webhook-test-1" }'

curl -X POST https://api.gemifier.io/v1/events \
  -H "Authorization: Bearer gem_sbox_..." \
  -H "Content-Type: application/json" \
  -d '{
        "events": [
          {
            "playerId": "webhook-test-1",
            "event": "lesson_completed",
            "occurredAt": "2026-08-20T09:14:22Z"
          }
        ]
      }'

curl -X POST https://api.gemifier.io/v1/missions \
  -H "Authorization: Bearer gem_sbox_..." \
  -H "Content-Type: application/json" \
  -d '{ "playerId": "webhook-test-1" }'