// Generated with: claude-managed-agents-webhooks skill
// https://github.com/hookdeck/webhook-skills
// Cliente: CULTIVA IA Platform — orquestación de agentes SEO/contenido

const express = require('express');
const crypto  = require('crypto');
const https   = require('https');
const { Pool } = require('pg');

const app  = express();
const db   = new Pool({ connectionString: process.env.DATABASE_URL });
const PORT = process.env.PORT || 3000;

// ─────────────────────────────────────────────────────────
// 1. Verificación de firma Standard Webhooks (HMAC-SHA256)
//    Spec: https://www.standardwebhooks.com/
// ─────────────────────────────────────────────────────────
function verifyClaudeSignature(payload, webhookId, webhookTimestamp, webhookSignature, secret) {
  if (!webhookId || !webhookTimestamp || !webhookSignature || !webhookSignature.includes(',')) {
    return false;
  }

  // Protección anti-replay: rechazar eventos con más de 5 min de antigüedad
  const currentTime   = Math.floor(Date.now() / 1000);
  const timestampDiff = currentTime - parseInt(webhookTimestamp);
  if (timestampDiff > 300 || timestampDiff < -300) {
    return false;
  }

  // Contenido firmado: "{webhookId}.{webhookTimestamp}.{rawBody}"
  const payloadStr    = payload instanceof Buffer ? payload.toString('utf8') : payload;
  const signedContent = `${webhookId}.${webhookTimestamp}.${payloadStr}`;

  // whsec_ es prefijo de una clave base64 de 32 bytes
  const secretKey   = secret.startsWith('whsec_') ? secret.slice(6) : secret;
  const secretBytes = Buffer.from(secretKey, 'base64');

  const expectedSig = crypto
    .createHmac('sha256', secretBytes)
    .update(signedContent, 'utf8')
    .digest('base64');

  // Soporta múltiples firmas "v1,sig1 v1,sig2" (rotación de claves)
  return webhookSignature.split(' ').some(pair => {
    const [version, signature] = pair.split(',');
    if (version !== 'v1' || !signature) return false;
    try {
      return crypto.timingSafeEqual(
        Buffer.from(signature),
        Buffer.from(expectedSig)
      );
    } catch { return false; }
  });
}

// ─────────────────────────────────────────────────────────
// 2. Helpers: PostgreSQL jobs + Slack notifications
// ─────────────────────────────────────────────────────────
async function updateJobStatus(sessionId, status, meta = {}) {
  await db.query(
    `UPDATE jobs
       SET status = $1, updated_at = NOW(), meta = meta || $2
     WHERE cma_session_id = $3`,
    [status, JSON.stringify(meta), sessionId]
  );
}

async function notifySlack(message, color = 'good') {
  const body = JSON.stringify({
    attachments: [{ color: color, text: message, footer: 'CULTIVA IA · CMA Webhooks' }]
  });
  await new Promise((resolve, reject) => {
    const url = new URL(process.env.SLACK_WEBHOOK_URL);
    const req = https.request({ hostname: url.hostname, path: url.pathname,
      method: 'POST', headers: { 'Content-Type': 'application/json' }
    }, res => res.on('data', () => {}).on('end', resolve));
    req.on('error', reject);
    req.end(body);
  });
}

// ─────────────────────────────────────────────────────────
// 3. Endpoint webhook — DEBE usar express.raw()
//    Si usas express.json() el body se parsea y la firma falla
// ─────────────────────────────────────────────────────────
app.post(
  '/webhooks/claude-managed-agents',
  express.raw({ type: 'application/json' }),
  async (req, res) => {
    const webhookId        = req.headers['webhook-id'];
    const webhookTimestamp = req.headers['webhook-timestamp'];
    const webhookSignature = req.headers['webhook-signature'];

    if (!verifyClaudeSignature(
      req.body, webhookId, webhookTimestamp, webhookSignature,
      process.env.ANTHROPIC_WEBHOOK_SIGNING_KEY
    )) {
      console.warn('[CMA] Firma inválida — posible replay o clave incorrecta');
      return res.status(400).json({ error: 'Invalid signature' });
    }

    const event     = JSON.parse(req.body.toString());
    const eventType = event.data?.type;   // ← data.type, NO top-level type
    const sessionId = event.data?.id;
    console.log(`[CMA] ${eventType} → ${sessionId}`);

    switch (eventType) {

      // Agente terminó su turno, espera input (éxito más frecuente)
      case 'session.status_idled':
        await updateJobStatus(sessionId, 'idled');
        await notifySlack(
          `:white_check_mark: Agente inactivo y listo\n*Sesión:* ${sessionId}`,
          'good'
        );
        break;

      // Error terminal — requiere intervención manual
      case 'session.status_terminated':
        await updateJobStatus(sessionId, 'terminated', { terminated_at: new Date().toISOString() });
        await notifySlack(
          `:x: Sesión terminada con error\n*Sesión:* ${sessionId}`,
          'danger'
        );
        break;

      // Agente coordinador abrió un subagente
      case 'session.thread_created':
        console.log(`[CMA] Nuevo hilo multiagente: ${sessionId}`);
        await updateJobStatus(sessionId, 'running_multiagent');
        break;

      // Credencial OAuth de vault no pudo refrescarse → alerta ops
      case 'vault_credential.refresh_failed':
        await notifySlack(
          `:warning: Vault credential refresh FAILED\n*ID:* ${sessionId}\nRevisa el vault en Anthropic Console`,
          'warning'
        );
        break;

      case 'session.status_run_started':
        await updateJobStatus(sessionId, 'running');
        break;

      case 'session.thread_idled':
      case 'session.thread_terminated':
        console.log(`[CMA] Thread lifecycle: ${eventType} → ${sessionId}`);
        break;

      default:
        console.log(`[CMA] Evento no manejado: ${eventType}`);
    }

    return res.status(200).json({ received: true });
  }
);

// Health check
app.get('/health', (_req, res) => res.json({ status: 'ok', service: 'cultiva-cma-webhooks' }));

app.listen(PORT, () =>
  console.log(`[CMA] Webhook handler escuchando en :${PORT}/webhooks/claude-managed-agents`)
);

# Tunnel sin cuenta (Hookdeck CLI)
npx hookdeck-cli listen 3000 claude-managed-agents \
  --path /webhooks/claude-managed-agents

# Resultado: URL pública → https://events.hookdeck.com/e/src_...
# Pegar esa URL en Anthropic Console → Settings → Webhooks → Add endpoint