# Before (staging)
ZENOO_API_KEY=stg_your_staging_key

# After (production)
ZENOO_API_KEY=prod_your_production_key

# Before (staging)
ZENOO_BASE_URL=https://instance.staging.onboardapp.io

# After (production)
ZENOO_BASE_URL=https://instance.prod.onboardapp.io

const crypto = require("crypto");

function verifySignature(rawBody, signature, secret) {
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

// Reject unverified webhooks
if (
  !verifySignature(rawBody, req.headers["x-zenoo-signature"], webhookSecret)
) {
  return res.status(401).json({ error: "Invalid signature" });
}

const RETRY_DELAYS = [0, 5000, 25000, 60000]; // 4 attempts max

async function callZenoo(requestFn) {
  for (let attempt = 0; attempt < RETRY_DELAYS.length; attempt++) {
    if (attempt > 0) await sleep(RETRY_DELAYS[attempt]);

    const response = await requestFn();

    if (response.status === 429) {
      const retryAfter = parseInt(response.headers.get("Retry-After") || "60");
      await sleep(retryAfter * 1000);
      continue;
    }

    if (response.status >= 500 && attempt < RETRY_DELAYS.length - 1) {
      continue;
    }

    return response;
  }
}

{
  "company_name": "Acme Holdings Ltd",
  "registration_number": "12345678",
  "country": "GB",
  "external_reference": "your-unique-internal-id-here"
}

app.post("/webhooks/zenoo", async (req, res) => {
  const { journey_id, event_type } = req.body;

  // Check for duplicate delivery
  const existing = await db.webhookEvents.findOne({ journey_id, event_type });
  if (existing) {
    return res.status(200).json({ received: true });
  }

  // Store before processing to prevent race conditions
  await db.webhookEvents.create({ journey_id, event_type, payload: req.body });
  await processEvent(req.body);

  res.status(200).json({ received: true });
});