Deliver Paperform submissions without leaking the whole payload.

import crypto from "node:crypto";

function sameSecret(supplied, expected) {
  if (!supplied || !expected) return false;
  const left = Buffer.from(supplied);
  const right = Buffer.from(expected);
  return left.length === right.length && crypto.timingSafeEqual(left, right);
}

function answer(payload, customKey) {
  const item = Array.isArray(payload.data)
    ? payload.data.find((field) => field?.custom_key === customKey)
    : undefined;
  return typeof item?.value === "string" ? item.value.trim() : undefined;
}

app.post(
  "/paperform/submission",
  (req, res, next) => {
    if (
      !sameSecret(
        req.get("X-Paperform-Webhook-Token"),
        process.env.PAPERFORM_WEBHOOK_TOKEN
      )
    ) {
      return res.sendStatus(401);
    }
    return next();
  },
  express.json({ limit: "64kb" }),
  async (req, res) => {
    const submissionId = req.body?.submission_id;
    const lead = {
      name: answer(req.body, "full_name"),
      email: answer(req.body, "email"),
      phone: answer(req.body, "phone")
    };
    if (typeof submissionId !== "string" || !lead.name || !lead.email) {
      await recordRejectedEntry({
        source: "paperform",
        reason: "missing_approved_fields"
      });
      return res.sendStatus(204);
    }

    await deliveryQueue.send({ submissionId, lead });
    return res.sendStatus(202);
  }
);

export async function deliverPaperformLead({ submissionId, lead }) {
  const response = await fetch(
    "https://leadproof.jessesay.chatgpt.site/api/v1/leads",
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.LEADPROOF_API_KEY}`,
        "Content-Type": "application/json",
        "Idempotency-Key": submissionId
      },
      body: JSON.stringify({
        destination: process.env.CRM_WEBHOOK_URL,
        ...lead,
        source: "paperform"
      })
    }
  );

  if (!response.ok) throw new Error("Lead delivery failed");
  const delivery = await response.json();
  await persistReceipt(submissionId, delivery.receipt?.id);
}