const crypto = require('crypto');

function verifyNotionSignature(rawBody, signatureHeader, verificationToken) {
  if (!signatureHeader || !verificationToken) return false;

  // Notion sends: sha256=<hex>
  const expected = `sha256=${crypto
    .createHmac('sha256', verificationToken)
    .update(rawBody)
    .digest('hex')}`;

  try {
    return crypto.timingSafeEqual(
      Buffer.from(expected),
      Buffer.from(signatureHeader)
    );
  } catch {
    return false;
  }
}

const express = require('express');
const app = express();

// CRITICAL: Use express.raw() - Notion requires raw body for signature verification
app.post('/webhooks/notion',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['x-notion-signature'];
    const token = process.env.NOTION_VERIFICATION_TOKEN;

    // Handshake: first delivery has no signature and contains verification_token
    if (!signature) {
      try {
        const parsed = JSON.parse(req.body.toString('utf8'));
        if (parsed && parsed.verification_token) {
          console.log('Notion verification_token (paste into Notion UI):', parsed.verification_token);
          return res.status(200).json({ received: true });
        }
      } catch { /* fall through */ }
      return res.status(400).send('Missing X-Notion-Signature');
    }

    if (!verifyNotionSignature(req.body, signature, token)) {
      return res.status(401).send('Invalid signature');
    }

    const event = JSON.parse(req.body.toString('utf8'));

    switch (event.type) {
      case 'page.content_updated':
        console.log('Page content updated:', event.entity?.id);
        break;
      case 'page.properties_updated':
        console.log('Page properties updated:', event.entity?.id);
        break;
      case 'comment.created':
        console.log('Comment created:', event.entity?.id);
        break;
      case 'data_source.schema_updated':
        console.log('Data source schema updated:', event.entity?.id);
        break;
      default:
        console.log('Unhandled event:', event.type);
    }

    res.json({ received: true });
  }
);

import hmac, hashlib, json
from fastapi import FastAPI, Request, HTTPException

def verify_notion_signature(raw_body: bytes, signature_header: str, token: str) -> bool:
    if not signature_header or not token:
        return False
    expected = "sha256=" + hmac.new(
        token.encode("utf-8"), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature_header)

@app.post("/webhooks/notion")
async def notion_webhook(request: Request):
    raw = await request.body()
    signature = request.headers.get("x-notion-signature")

    # Handshake: first delivery has no signature and contains verification_token
    if not signature:
        try:
            data = json.loads(raw)
            if "verification_token" in data:
                print("Notion verification_token:", data["verification_token"])
                return {"received": True}
        except Exception:
            pass
        raise HTTPException(status_code=400, detail="Missing X-Notion-Signature")

    if not verify_notion_signature(raw, signature, os.environ["NOTION_VERIFICATION_TOKEN"]):
        raise HTTPException(status_code=401, detail="Invalid signature")

    event = json.loads(raw)
    # handle event.type ...
    return {"received": True}

# verification_token captured during the handshake (NOT the integration's API token)
NOTION_VERIFICATION_TOKEN=secret_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Start tunnel (no account needed, Notion does NOT support localhost)
npx hookdeck-cli listen 3000 notion --path /webhooks/notion

// Generated with: notion-webhooks skill
// https://github.com/hookdeck/webhook-skills