Turn each Fillout submission into a duplicate-safe CRM receipt.

import crypto from "node:crypto";

function sameSecret(supplied, expected) {
  if (!supplied || !expected) return false;
  const left = Buffer.from(supplied);
  const right = Buffer.from(expected);
  return left.length === right.length && crypto.timingSafeEqual(left, right);
}

function answerByName(questions, names) {
  const allowed = new Set(names.map((name) => name.toLowerCase()));
  const match = questions.find(
    (question) =>
      typeof question?.name === "string" &&
      allowed.has(question.name.toLowerCase()) &&
      typeof question.value === "string"
  );
  return match?.value;
}

app.post(
  "/fillout/submission",
  express.json({ limit: "64kb" }),
  async (req, res) => {
    if (
      !sameSecret(
        req.get("X-Fillout-Token"),
        process.env.FILLOUT_WEBHOOK_TOKEN
      )
    ) {
      return res.sendStatus(401);
    }

    const submissionId = req.body?.submissionId;
    const questions = Array.isArray(req.body?.questions)
      ? req.body.questions
      : [];
    if (typeof submissionId !== "string" || !submissionId) {
      return res.sendStatus(400);
    }

    const lead = {
      name: answerByName(questions, ["name", "full name"]),
      email: answerByName(questions, ["email", "work email"]),
      phone: answerByName(questions, ["phone", "phone number"])
    };
    if (!lead.name || !lead.email) return res.sendStatus(202);

    await deliveryQueue.send({ submissionId, lead });
    return res.sendStatus(202);
  }
);

export async function deliverFilloutLead({ submissionId, lead }) {
  const response = await fetch(
    "https://leadproof.jessesay.chatgpt.site/api/v1/leads",
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.LEADPROOF_API_KEY}`,
        "Content-Type": "application/json",
        "Idempotency-Key": submissionId
      },
      body: JSON.stringify({
        destination: process.env.CRM_WEBHOOK_URL,
        ...lead,
        source: "fillout_form"
      })
    }
  );

  if (!response.ok) throw new Error("Lead delivery failed");
  const delivery = await response.json();
  await persistReceipt(submissionId, delivery.receipt?.id);
}