Webhooks

result = client.webhooks.list
result.data  # => Array of Webhook objects

webhook = client.webhooks.create(
  url:    "https://yourapp.com/webhooks/whatsrb",
  events: ["message.received", "message.status", "message.failed"]
)

webhook.id      # => 1
webhook.url     # => "https://yourapp.com/webhooks/whatsrb"
webhook.events  # => ["message.received", "message.status", "message.failed"]
webhook.secret  # => "whsec_xxx"  — only present on create, store it now!
webhook.active? # => true

webhook = client.webhooks.retrieve(1)

webhook = client.webhooks.update(1,
  url:    "https://yourapp.com/new-path",
  active: false,
  events: ["message.failed"]
)

client.webhooks.delete(1)  # => true

# Handles body reading, rewinding, and header extraction automatically
WhatsrbCloud::WebhookSignature.verify_request(request, secret: ENV["WHATSRB_WEBHOOK_SECRET"])

WhatsrbCloud::WebhookSignature.verify?(
  payload: request.body.read,
  signature: request.headers["X-Webhook-Signature"],
  secret: ENV["WHATSRB_WEBHOOK_SECRET"]
)

class WebhooksController < ApplicationController
  skip_forgery_protection

  def create
    unless WhatsrbCloud::WebhookSignature.verify_request(request, secret: webhook_secret)
      return head :unauthorized
    end

    Rails.application.config.event_registry.dispatch(payload)
    head :ok
  end

  private

  def payload = @payload ||= JSON.parse(request.body.read)
  def webhook_secret = ENV["WHATSRB_WEBHOOK_SECRET"]
end