Webhook Rehberi

# Webhook kuralı oluştur
curl -X POST https://duzenal.com/api/v1/webhooks/rules-engine/rules \
  -H "X-API-Key: ctx_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Yeni lead bildir",
    "event": "lead.created",
    "url": "https://siteniz.com/api/cortex-webhook",
    "secret": "wh_sec_your_signing_secret",
    "conditions": {
      "min_confidence": 0.8
    },
    "active": true
  }'

# Yanıt
{
  "ok": true,
  "rule_id": "rule_abc123",
  "event": "lead.created",
  "active": true,
  "created_at": "2026-05-31T10:00:00Z"
}

{
  "event": "lead.created",
  "webhook_id": "wh_abc123",
  "timestamp": "2026-05-31T10:15:00Z",
  "data": {
    "lead_id": "lead_xyz789",
    "chatbot_id": "bot_abc123",
    "session_id": "ses_def456",
    "sector": "plastik-cerrahi",
    "name": "Mehmet Yılmaz",
    "phone": "+905551234567",
    "email": "[email protected]",
    "interest": "Burun estetiği",
    "source": "website_widget",
    "captured_at": "2026-05-31T10:14:58Z"
  },
  "signature": "sha256=a1b2c3d4e5f6..."
}

# Node.js — HMAC imza doğrulama
const crypto = require("crypto");

function verifyWebhookSignature(payload, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(JSON.stringify(payload))
    .digest("hex");

  const received = signature.replace("sha256=", "");
  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(received, "hex")
  );
}

// Express middleware örneği
app.post("/api/cortex-webhook", express.raw({ type: "application/json" }), (req, res) => {
  const signature = req.headers["x-cortex-signature"];
  const isValid = verifyWebhookSignature(
    JSON.parse(req.body),
    signature,
    process.env.WEBHOOK_SECRET
  );

  if (!isValid) {
    return res.status(401).json({ error: "Invalid signature" });
  }

  const event = JSON.parse(req.body);
  console.log("Event:", event.event, event.data);

  // İşlemi hızlı yapın ve 200 dönün
  res.status(200).json({ received: true });
});