Receber mensagens de WhatsApp em Node.js

import express from "express";
import { createHmac, timingSafeEqual } from "crypto";

const app = express();
const SECRET = process.env.WPPAPI_WEBHOOK_SECRET;

// Importante: o HMAC é calculado sobre os BYTES EXATOS do body.
// Use express.raw() na rota do webhook — não express.json().
app.post(
  "/webhooks/wppapi",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.header("X-WPPAPI-Signature") ?? "";
    const expected = createHmac("sha256", SECRET)
      .update(req.body)
      .digest("hex");

    const valid =
      signature.length === expected.length &&
      timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

    if (!valid) return res.status(401).send("invalid signature");

    const event = JSON.parse(req.body.toString("utf8"));

    if (event.event === "received" && !event.data?.fromMe) {
      console.log("Mensagem de", event.data.from, ":", event.data.body);
      // Enfileire o processamento pesado e responda 200 rápido.
    }

    res.sendStatus(200);
  }
);

app.listen(3000);