Webhooks (events and X-Victus-Signature HMAC verification)

# See current webhook config
curl https://control.victuscloud.com/api/reseller/v1/webhooks \
  -H "Authorization: Bearer $VICTUS_KEY"

# Set (or update) the delivery URL and subscribed events
curl -X PUT https://control.victuscloud.com/api/reseller/v1/webhooks \
  -H "Authorization: Bearer $VICTUS_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://yourstore.com/hooks/victus",
    "events": ["service.ready", "service.suspended", "account.low_balance"]
  }'

const crypto = require('crypto');

function verifyVictus(rawBody, signatureHeader, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody) // the RAW request body, before JSON.parse
    .digest('hex');
  const a = Buffer.from(expected);
  const b = Buffer.from(signatureHeader || '');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Express example (use the raw body, not the parsed one)
app.post('/hooks/victus', express.raw({ type: '*/*' }), (req, res) => {
  const sig = req.header('X-Victus-Signature');
  if (!verifyVictus(req.body, sig, process.env.VICTUS_WEBHOOK_SECRET)) {
    return res.status(400).send('bad signature');
  }
  const event = JSON.parse(req.body.toString('utf8'));
  // handle event.type ...
  res.sendStatus(200);
});