<transmissionId>|<transmissionTime>|<webhookId>|<crc32(rawBody)>

const express = require('express');
const crypto = require('crypto');
const zlib = require('zlib');
const https = require('https');

const app = express();
const certCache = new Map();

function fetchCert(certUrl) {
  // SECURITY: Only trust certs served from paypal.com
  const host = new URL(certUrl).hostname;
  if (host !== 'paypal.com' && !host.endsWith('.paypal.com')) {
    return Promise.reject(new Error('Cert URL host is not paypal.com'));
  }
  if (certCache.has(certUrl)) return Promise.resolve(certCache.get(certUrl));
  return new Promise((resolve, reject) => {
    https.get(certUrl, (res) => {
      let data = '';
      res.on('data', (c) => (data += c));
      res.on('end', () => { certCache.set(certUrl, data); resolve(data); });
    }).on('error', reject);
  });
}

async function verifyPayPalWebhook(headers, rawBody, webhookId) {
  const transmissionId = headers['paypal-transmission-id'];
  const transmissionTime = headers['paypal-transmission-time'];
  const transmissionSig = headers['paypal-transmission-sig'];
  const certUrl = headers['paypal-cert-url'];
  if (!transmissionId || !transmissionTime || !transmissionSig || !certUrl) {
    return false;
  }
  const crc = zlib.crc32(rawBody);
  const message = `${transmissionId}|${transmissionTime}|${webhookId}|${crc}`;
  const cert = await fetchCert(certUrl);
  const verifier = crypto.createVerify('SHA256');
  verifier.update(message);
  verifier.end();
  try {
    return verifier.verify(cert, transmissionSig, 'base64');
  } catch {
    return false;
  }
}

// CRITICAL: express.raw() — PayPal verification needs the raw body for CRC32
app.post('/webhooks/paypal',
  express.raw({ type: 'application/json' }),
  async (req, res) => {
    const ok = await verifyPayPalWebhook(
      req.headers,
      req.body,
      process.env.PAYPAL_WEBHOOK_ID
    );
    if (!ok) return res.status(400).send('Invalid signature');

    const event = JSON.parse(req.body.toString('utf8'));
    switch (event.event_type) {
      case 'PAYMENT.CAPTURE.COMPLETED':
        console.log('Capture completed:', event.resource.id);
        break;
      case 'PAYMENT.CAPTURE.REFUNDED':
        console.log('Refund issued:', event.resource.id);
        break;
      case 'BILLING.SUBSCRIPTION.CREATED':
        console.log('Subscription created:', event.resource.id);
        break;
      case 'CHECKOUT.ORDER.APPROVED':
        console.log('Order approved:', event.resource.id);
        break;
      default:
        console.log('Unhandled event:', event.event_type);
    }
    res.json({ received: true });
  }
);

import os, zlib, base64, httpx
from urllib.parse import urlparse
from fastapi import FastAPI, Request, HTTPException
from cryptography import x509
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.exceptions import InvalidSignature

app = FastAPI()
_cert_cache: dict[str, bytes] = {}

def fetch_cert(cert_url: str) -> bytes:
    host = urlparse(cert_url).hostname or ""
    if host != "paypal.com" and not host.endswith(".paypal.com"):
        raise ValueError("Cert URL host is not paypal.com")
    if cert_url in _cert_cache:
        return _cert_cache[cert_url]
    pem = httpx.get(cert_url, timeout=10).content
    _cert_cache[cert_url] = pem
    return pem

def verify_paypal_webhook(headers, raw_body: bytes, webhook_id: str) -> bool:
    transmission_id = headers.get("paypal-transmission-id")
    transmission_time = headers.get("paypal-transmission-time")
    transmission_sig = headers.get("paypal-transmission-sig")
    cert_url = headers.get("paypal-cert-url")
    if not all([transmission_id, transmission_time, transmission_sig, cert_url]):
        return False
    crc = zlib.crc32(raw_body) & 0xFFFFFFFF
    message = f"{transmission_id}|{transmission_time}|{webhook_id}|{crc}".encode()
    cert_pem = fetch_cert(cert_url)
    public_key = x509.load_pem_x509_certificate(cert_pem).public_key()
    try:
        public_key.verify(
            base64.b64decode(transmission_sig),
            message,
            padding.PKCS1v15(),
            hashes.SHA256(),
        )
        return True
    except InvalidSignature:
        return False

@app.post("/webhooks/paypal")
async def paypal_webhook(request: Request):
    raw = await request.body()
    if not verify_paypal_webhook(request.headers, raw, os.environ["PAYPAL_WEBHOOK_ID"]):
        raise HTTPException(status_code=400, detail="Invalid signature")
    event = await request.json()
    # handle event.event_type ...
    return {"received": True}

PAYPAL_WEBHOOK_ID=4JH86294D6297351H        # From PayPal app webhook settings
PAYPAL_CLIENT_ID=AYS...                    # Only needed for the postback verify path
PAYPAL_CLIENT_SECRET=EC...                 # Only needed for the postback verify path
PAYPAL_ENV=sandbox                          # sandbox | live

# Start tunnel (no account needed)
npx hookdeck-cli listen 3000 paypal --path /webhooks/paypal

// Generated with: paypal-webhooks skill
// https://github.com/hookdeck/webhook-skills