Make Cognito Forms webhook retries safe for the CRM.

import crypto from "node:crypto";

function sameSecret(supplied, expected) {
  if (!supplied || !expected) return false;
  const left = Buffer.from(supplied);
  const right = Buffer.from(expected);
  return left.length === right.length && crypto.timingSafeEqual(left, right);
}

app.post(
  "/cognito/submission/:token",
  (req, res, next) => {
    if (
      !sameSecret(
        req.params.token,
        process.env.COGNITO_WEBHOOK_ROUTE_TOKEN
      )
    ) {
      return res.sendStatus(404);
    }
    return next();
  },
  express.json({ limit: "64kb" }),
  async (req, res) => {
    const entryId = req.body?.id;
    const lead = {
      name: typeof req.body?.name === "string" ? req.body.name : undefined,
      email: typeof req.body?.email === "string" ? req.body.email : undefined,
      phone: typeof req.body?.phone === "string" ? req.body.phone : undefined
    };
    if (typeof entryId !== "string" || !lead.name || !lead.email) {
      await recordRejectedEntry({
        source: "cognito_forms",
        reason: "missing_approved_fields"
      });
      return res.sendStatus(204);
    }

    await deliveryQueue.send({ entryId, lead });
    return res.sendStatus(202);
  }
);

export async function deliverCognitoLead({ entryId, lead }) {
  const response = await fetch(
    "https://leadproof.jessesay.chatgpt.site/api/v1/leads",
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.LEADPROOF_API_KEY}`,
        "Content-Type": "application/json",
        "Idempotency-Key": entryId
      },
      body: JSON.stringify({
        destination: process.env.CRM_WEBHOOK_URL,
        ...lead,
        source: "cognito_forms"
      })
    }
  );

  if (!response.ok) throw new Error("Lead delivery failed");
  const delivery = await response.json();
  await persistReceipt(entryId, delivery.receipt?.id);
}