Webhooks

Contoh flow: lead baru masuk
1. Customer klik WhatsApp dari landing page.
2. Lead tercatat di Dalekta.
3. Dalekta membuat event `lead.created`.
4. Dalekta POST payload ke endpoint webhook yang subscribe `lead.created`.
5. Receiver verify `X-Dalekta-Signature`.
6. Receiver simpan `payload.id` untuk idempotency.
7. Receiver upsert contact/deal di CRM.
8. Receiver balas HTTP 200 agar delivery dianggap sukses.

Content-Type: application/json
X-Dalekta-Signature: t=1785074400,v1=<hex_hmac_sha256>
X-Dalekta-Event: lead.status_changed
X-Dalekta-Delivery-Id: whd_xxx
User-Agent: Dalekta-Webhook/1.0

{
  "id": "evt_xxx",
  "type": "lead.status_changed",
  "createdAt": "2026-07-26T14:00:00.000Z",
  "workspace": {
    "id": "workspace_id",
    "name": "Workspace name"
  },
  "data": {
    "lead": {
      "id": "lead_id",
      "status": "CLOSING"
    }
  }
}

const crypto = require("crypto");

function verifyDalektaSignature(rawBody, signatureHeader, secret) {
  const parts = Object.fromEntries(
    String(signatureHeader || "")
      .split(",")
      .map((part) => part.trim().split("="))
      .filter(([key, value]) => key && value)
  );

  const timestamp = Number(parts.t);
  const signature = parts.v1;
  if (!Number.isFinite(timestamp) || !signature) return false;

  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - timestamp) > 300) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(timestamp + "." + rawBody)
    .digest("hex");

  const actualBuffer = Buffer.from(signature, "hex");
  const expectedBuffer = Buffer.from(expected, "hex");
  return actualBuffer.length === expectedBuffer.length && crypto.timingSafeEqual(actualBuffer, expectedBuffer);
}

const express = require("express");
const app = express();

app.post("/dalekta/webhook", express.raw({ type: "application/json" }), async (req, res) => {
  const rawBody = req.body.toString("utf8");
  const secret = process.env.DALEKTA_WEBHOOK_SECRET;

  if (!verifyDalektaSignature(rawBody, req.header("X-Dalekta-Signature"), secret)) {
    return res.status(401).json({ error: "invalid_signature" });
  }

  const event = JSON.parse(rawBody);
  const deliveryId = req.header("X-Dalekta-Delivery-Id");

  // Simpan event.id atau deliveryId sebagai idempotency key sebelum menjalankan side effect.
  if (await alreadyProcessed(event.id)) {
    return res.status(200).json({ ok: true, duplicate: true });
  }

  await markProcessed(event.id, deliveryId);
  await handleDalektaEvent(event);

  return res.status(200).json({ ok: true });
});

{
  "id": "evt_lead_status_changed_xxx",
  "type": "lead.status_changed",
  "createdAt": "2026-07-26T14:00:00.000Z",
  "workspace": {
    "id": "workspace_id",
    "name": "Workspace name"
  },
  "data": {
    "lead": {
      "id": "lead_id",
      "status": "CLOSING",
      "previousStatus": "BOOKING",
      "currency": "IDR",
      "closingValue": 2500000,
      "closingDate": "2026-07-26T14:00:00.000Z"
    },
    "attribution": {
      "sourcePlatform": "meta",
      "utmCampaign": "campaign_name",
      "adId": "ad_id"
    }
  }
}

{
  "id": "evt_chat_message_created_xxx",
  "type": "chat.message.created",
  "createdAt": "2026-07-26T14:00:00.000Z",
  "workspace": {
    "id": "workspace_id",
    "name": "Workspace name"
  },
  "data": {
    "message": {
      "id": "wa_message_id",
      "leadId": "lead_id",
      "waSessionId": "wa_session_id",
      "direction": "inbound",
      "type": "text",
      "timestamp": "2026-07-26T14:00:00.000Z"
    },
    "customer": {
      "phoneNumber": "628xxxxxxxxxx",
      "name": "Customer name"
    },
    "content": {
      "availableViaAgentApi": true
    }
  }
}