{
  "id": "0f1e2d3c-4b5a-4968-8776-655443322110",
  "type": "email.bounced",
  "createdAt": "2026-09-24T08:16:02.000Z",
  "data": {
    "messageId": "1f2e3d4c-5b6a-4798-8a9b-0c1d2e3f4a5b@dukalangu.co.tz",
    "recipient": "juma@example.co.tz",
    "status": "bounced",
    "dsn": "5.1.1",
    "detail": "550 5.1.1 The email account that you tried to reach does not exist",
    "occurredAt": "2026-09-24T08:15:41.000Z",
    "from": "receipts@dukalangu.co.tz"
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";
import express from "express";

const app = express();

// The signature covers the bytes exactly as sent, so keep the raw body and
// parse it only after the check has passed.
app.post("/hooks/barua", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("X-Barua-Signature") ?? "";
  const parts = Object.fromEntries(header.split(",").map((part) => part.split("=")));
  const { t, v1 } = parts;
  if (!t || !v1) return res.status(400).end();

  // Your choice, not a Barua rule: refuse a signature older than five minutes,
  // so a captured request cannot be replayed at you later.
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return res.status(400).end();

  const rawBody = req.body.toString("utf8");
  const expected = createHmac("sha256", process.env.BARUA_WEBHOOK_SECRET)
    .update(`${t}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(v1, "hex");
  if (a.length !== b.length || !timingSafeEqual(a, b)) return res.status(401).end();

  const event = JSON.parse(rawBody);
  // event.type is "email.bounced" and so on. event.id is the delivery id, also
  // in X-Barua-Delivery, so a retry you have already handled can be dropped.
  if (event.type === "email.bounced") {
    // mark event.data.recipient as undeliverable in your own records
  }

  // Answer 2xx within 10 seconds. Anything else, or silence, is retried.
  res.status(200).end();
});

app.listen(3000);