// HTTP front door: receives GitHub webhooks, verifies HMAC, and enqueues review jobs.

const express = require('express');

const { cfg } = require('./config');

const { log } = require('./logger');

const { reviewQueue } = require('./queue');

const { verifySignature } = require('./signature');

function startWeb() {

const app = express();

// Capture the exact raw bytes GitHub signed so we can verify the HMAC.

app.use(express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }));

app.post('/webhook', async (req, res) => {

const deliveryId = req.get('X-GitHub-Delivery') || '';

try {

const event = req.get('X-GitHub-Event');

if (!verifySignature(req.rawBody, req.get('X-Hub-Signature-256'), cfg.webhookSecret)) {

return res.status(401).json({ error: 'invalid signature' });

}

const body = req.body;

const actionable = event === 'pull_request'

&& ['opened', 'synchronize', 'reopened'].includes(body.action);

if (!actionable) {

return res.status(204).end();

}

const job = {

deliveryId,

repoOwner: body.repository.owner.login,

repoName: body.repository.name,

prNumber: body.pull_request.number,

headSha: body.pull_request.head.sha,

};

await reviewQueue.add('review', job, {

jobId: deliveryId,

attempts: cfg.maxAttempts,

backoff: { type: 'exponential', delay: 2000 },

removeOnComplete: 1000,

removeOnFail: false,

});

return res.status(202).json({ status: 'queued', deliveryId });

} catch (e) {

log('error', deliveryId, 'webhook handler failed', { err: e.message });

return res.status(500).json({ error: 'internal' });

}

});

app.get('/healthz', (_req, res) => res.json({ ok: true }));

return app.listen(cfg.port, () => log('info', '-', `web listening on :${cfg.port}`));

}

module.exports = { startWeb };