CRM sync with webhooks

mkdir jelliu-crm-sync && cd jelliu-crm-sync
npm init -y
npm pkg set type=module
npm install express

import crypto from 'node:crypto';
import express from 'express';
const SECRET = process.env.JELLIU_WEBHOOK_SECRET; // "whsec_..."
const PORT = Number(process.env.PORT ?? 3000);
const TOLERANCE_SECONDS = 5 * 60;
const MAX_WORKER_TRIES = 5;
if (!SECRET) {
  console.error('Set JELLIU_WEBHOOK_SECRET before starting the receiver.');
  process.exit(1);
}
// The HMAC key is the base64-DECODED part after "whsec_", not the string itself.
const KEY = Buffer.from(SECRET.startsWith('whsec_') ? SECRET.slice(6) : SECRET, 'base64');
// In-memory stores keep the example self-contained. In production use a
// database table with a unique constraint, or Redis SET NX with a TTL.
const seenEvents = new Map(); // webhook-id -> first seen (ms)
const writtenCalls = new Map(); // "type:call_id" -> written at (ms)
const queue = [];
// Map Jelliu outcomes to your CRM's stages. Anything unmapped is "contacted".
const STAGE_BY_OUTCOME = {
  sale_closed: 'won',
  callback_scheduled: 'follow_up',
  appointment_booked: 'meeting_booked',
  rejected: 'lost',
  no_answer: 'not_reached',
  voicemail: 'not_reached',
  busy: 'not_reached',
  failed: 'not_reached',
};
function signatureIsValid(id, timestamp, rawBody, header) {
  const expected = crypto
    .createHmac('sha256', KEY)
    .update(`${id}.${timestamp}.${rawBody}`)
    .digest('base64');
  // Space-separated "v1,<base64>" entries; any one matching is enough.
  return header.split(' ').some((entry) => {
    const [version, signature] = entry.split(',', 2);
    if (version !== 'v1' || !signature) return false;
    const a = Buffer.from(signature);
    const b = Buffer.from(expected);
    return a.length === b.length && crypto.timingSafeEqual(a, b);
  });
}
const app = express();
app.post('/webhooks/jelliu', express.raw({ type: 'application/json', limit: '1mb' }), (req, res) => {
  const id = req.get('webhook-id') ?? '';
  const timestamp = req.get('webhook-timestamp') ?? '';
  const signature = req.get('webhook-signature') ?? '';
  const attempt = req.get('x-jelliu-attempt') ?? '1';
  if (!Buffer.isBuffer(req.body)) {
    return res.status(400).json({ error: 'Expected a JSON body' });
  }
  const rawBody = req.body.toString('utf8');
  if (!id || !timestamp || !signature) {
    return res.status(400).json({ error: 'Missing webhook headers' });
  }
  const ts = Number(timestamp); // Unix seconds, set at send time on every attempt
  if (!Number.isInteger(ts) || Math.abs(Date.now() / 1000 - ts) > TOLERANCE_SECONDS) {
    return res.status(400).json({ error: 'Timestamp outside tolerance' });
  }
  if (!signatureIsValid(id, timestamp, rawBody, signature)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  if (seenEvents.has(id)) {
    console.log(`Duplicate event ${id} ignored (attempt ${attempt})`);
    return res.status(200).json({ status: 'duplicate' });
  }
  let event;
  try {
    event = JSON.parse(rawBody);
  } catch {
    return res.status(400).json({ error: 'Malformed JSON' });
  }
  seenEvents.set(id, Date.now());
  queue.push({ event, tries: 0 });
  console.log(`Queued ${event.type} (attempt ${attempt})`);
  return res.status(200).json({ status: 'queued' });
});
async function writeCallToCrm(event) {
  const d = event.data ?? {};
  const record = {
    externalId: `jelliu-call-${d.call_id}`,
    phone: d.phone_number ?? null,
    stage: STAGE_BY_OUTCOME[d.outcome] ?? 'contacted',
    outcome: d.outcome ?? null,
    failureReason: d.reason ?? null, // call.failed only
    summary: d.summary ?? null,
    durationSeconds: d.duration ?? null,
    sentiment: d.sentiment_score ?? null,
    extracted: d.data_collection ?? null,
    jelliu: { callId: d.call_id, contactId: d.contact_id, campaignId: d.campaign_id, agentId: d.agent_id },
    occurredAt: event.created_at,
  };
  if (!process.env.CRM_API_URL) {
    console.log('CRM write (dry run):', JSON.stringify(record));
    return;
  }
  // Replace with your CRM's upsert call. Keying the write on externalId
  // makes a repeated write update the same record instead of creating one.
  const res = await fetch(`${process.env.CRM_API_URL}/activities/${record.externalId}`, {
    method: 'PUT',
    headers: {
      Authorization: `Bearer ${process.env.CRM_API_TOKEN}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify(record),
    signal: AbortSignal.timeout(15_000),
  });
  if (!res.ok) throw new Error(`CRM responded ${res.status}`);
  console.log(`CRM upserted ${record.externalId}`);
}
async function processEvent(event) {
  switch (event.type) {
    case 'call.completed':
    case 'call.failed': {
      const key = `${event.type}:${event.data?.call_id}`;
      if (writtenCalls.has(key)) {
        console.log(`Already written: ${key}`);
        return;
      }
      await writeCallToCrm(event);
      writtenCalls.set(key, Date.now());
      return;
    }
    default:
      console.log(`Ignoring ${event.type}`);
  }
}
let draining = false;
async function drain() {
  if (draining) return;
  draining = true;
  try {
    while (queue.length > 0) {
      const job = queue.shift();
      try {
        await processEvent(job.event);
      } catch (err) {
        job.tries += 1;
        if (job.tries < MAX_WORKER_TRIES) {
          const delayMs = 2 ** job.tries * 1000;
          console.warn(`Write failed (${err.message}); retrying in ${delayMs} ms`);
          setTimeout(() => queue.push(job), delayMs);
        } else {
          console.error(`Giving up on ${job.event.type}:`, err.message);
        }
      }
    }
  } finally {
    draining = false;
  }
}
setInterval(drain, 500);
app.listen(PORT, () => console.log(`Listening on http://localhost:${PORT}/webhooks/jelliu`));

ngrok http 3000

curl -sS -X POST "https://api.jelliu.co/api/webhooks" \
  -H "Authorization: Bearer $JELLIU_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://4f2a-203-0-113-7.ngrok-free.app/webhooks/jelliu",
    "events": ["call.completed", "call.failed"],
    "description": "CRM sync (local test)"
  }'

export JELLIU_WEBHOOK_SECRET="whsec_..."
node server.mjs

// send-test-event.mjs
import crypto from 'node:crypto';
const url = process.argv[2] ?? 'http://localhost:3000/webhooks/jelliu';
const secret = process.env.JELLIU_WEBHOOK_SECRET;
const key = Buffer.from(secret.slice('whsec_'.length), 'base64');
const eventId = `evt_TEST${crypto.randomBytes(11).toString('hex').toUpperCase()}`;
const body = JSON.stringify({
  id: eventId,
  type: 'call.completed',
  api_version: '2026-09-27',
  created_at: new Date().toISOString(),
  tenant_id: '7a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d',
  data: {
    call_id: '5b0d2f7e-9a41-4c3e-8f0a-2c6d1e7b9a10',
    campaign_id: '0f3c8b52-6d1a-4e2f-9b7c-4a5e6d7f8a90',
    contact_id: 'a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d',
    agent_id: '7c1d9f30-5e2a-4a7e-9c8f-91a0b1c2d3e4',
    phone_number: '+573001234567',
    outcome: 'callback_scheduled',
    sentiment_score: 0.6,
    duration: 184,
    summary: 'El cliente pidió que lo llamen el jueves en la tarde.',
    data_collection: { preferred_time: 'jueves en la tarde' },
    kpi_data: null,
  },
});
// Send the same event twice, the way a retry would arrive: same
// webhook-id and body, a fresh timestamp and signature each attempt.
for (const attempt of [1, 2]) {
  const timestamp = String(Math.floor(Date.now() / 1000));
  const signature = 'v1,' + crypto.createHmac('sha256', key).update(`${eventId}.${timestamp}.${body}`).digest('base64');
  const res = await fetch(url, {
    method: 'POST',
    headers: {
      'content-type': 'application/json',
      'webhook-id': eventId,
      'webhook-timestamp': timestamp,
      'webhook-signature': signature,
      'x-jelliu-event-type': 'call.completed',
      'x-jelliu-attempt': String(attempt),
    },
    body,
  });
  console.log(res.status, await res.text());
}

curl -sS "https://api.jelliu.co/api/webhooks/b3d1f0e2-7a6c-4e5b-9d8f-1a2b3c4d5e6f/deliveries?limit=5" \
  -H "Authorization: Bearer $JELLIU_API_KEY"