Build an approvals notifier

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.ONTIME_WEBHOOK_SECRET!;
const CHAT_WEBHOOK = process.env.CHAT_WEBHOOK_URL!;

const LABELS: Record<string, string> = {
  "leave.approved": "✅ Leave approved",
  "leave.rejected": "❌ Leave rejected",
  "regularization.approved": "✅ Attendance correction approved",
  "regularization.rejected": "❌ Attendance correction rejected",
  "overtime.approved": "✅ Overtime approved",
  "overtime.rejected": "❌ Overtime rejected",
};

const seen = new Set<string>(); // use a durable store in production

app.post(
  "/webhooks/ontime",
  express.raw({ type: "application/json" }),
  async (req, res) => {
    const expected =
      "sha256=" +
      crypto.createHmac("sha256", SECRET).update(req.body).digest("hex");
    const got = req.get("X-Ontime-Signature") ?? "";

    const a = Buffer.from(got);
    const b = Buffer.from(expected);
    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.sendStatus(401);
    }

    // Acknowledge before doing anything — the delivery times out at 30s.
    res.sendStatus(200);

    const deliveryId = req.get("X-Ontime-Delivery")!;
    if (seen.has(deliveryId)) return; // at-least-once: deduplicate
    seen.add(deliveryId);

    const payload = JSON.parse(req.body.toString("utf8"));
    const label = LABELS[payload.event];
    if (!label) return; // unknown event: acknowledged, ignored

    // The payload carries a reference, not the record. Resolve the employee name
    // from your own cache of GET /api/public/v1/employees.
    const who = await employeeName(payload.data.recipientId);

    await fetch(CHAT_WEBHOOK, {
      method: "POST",
      headers: { "content-type": "application/json" },
      body: JSON.stringify({ text: `${label} — ${who}` }),
    });
  },
);