Receive Prophic Pipeline Events with Webhooks

{
  "id": "evt_<uuid>",
  "type": "quotation.proposal.completed",
  "created_at": "2026-09-01T12:00:00.000Z",
  "organization_id": "<uuid>",
  "data": {
    "quotation_id": "<uuid>",
    "proposal_id": "<uuid|null>",
    "step": "proposal",
    "status": "completed",
    "error_code": null,
    "generation_source": "api_key"
  }
}

import crypto from "crypto";

function verifyProphicSignature(rawBody, headers, secret) {
  const timestamp = headers["x-prophic-timestamp"];
  const signature = headers["x-prophic-signature"];

  // Reject stale requests (5-minute window).
  const age = Math.floor(Date.now() / 1000) - Number(timestamp);
  if (Math.abs(age) > 300) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const provided = signature.replace(/^v1=/, "");
  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(provided, "hex")
  );
}