Eventos en tiempo real

{
  "id": "evt_2026_05_27_abc123",
  "type": "invoice.issued",
  "createdAt": "2026-05-27T10:23:45.000Z",
  "tenantId": "tnt_xxx",
  "data": {
    "invoiceId": "inv_2026_0042",
    "number": "2026/0042",
    "amount": 1210.00,
    "verifactuHash": "a1b2c3d4...",
    "aeatStatus": "registered"
  }
}

// Verificación de firma HMAC (Node.js)
import crypto from 'node:crypto';

function verifyWebhook(req, secret) {
  const signature = req.headers['x-isaak-signature'];
  const timestamp = req.headers['x-isaak-timestamp'];
  const body = req.rawBody; // ¡el cuerpo crudo, NO parseado!

  // Rechazar si la firma tiene más de 5 minutos (anti-replay)
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    throw new Error('Timestamp fuera de ventana');
  }

  const payload = `${timestamp}.${body}`;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    throw new Error('Firma inválida');
  }
}