Deliver every Tally form lead to the CRM once—with proof.

import crypto from "node:crypto";

app.use(
  "/tally/form-response",
  express.raw({ type: "application/json" })
);

app.post("/tally/form-response", async (req, res) => {
  const signature = req.headers["tally-signature"];
  const secret = process.env.TALLY_WEBHOOK_SECRET;
  if (!signature || typeof signature !== "string" || !secret) {
    return res.sendStatus(401);
  }

  const expected = crypto
    .createHmac("sha256", secret)
    .update(req.body)
    .digest();
  const supplied = Buffer.from(signature, "base64");
  const authentic =
    supplied.length === expected.length &&
    crypto.timingSafeEqual(supplied, expected);
  if (!authentic) return res.sendStatus(401);

  const event = JSON.parse(req.body.toString("utf-8"));
  if (event.eventType !== "FORM_RESPONSE") return res.sendStatus(204);

  const fields = event.data?.fields ?? [];
  const valueFor = (type, label) =>
    fields.find(
      (field) =>
        field.type === type &&
        (!label || field.label?.toLowerCase() === label)
    )?.value;

  const lead = {
    name: valueFor("INPUT_TEXT", "name"),
    email: valueFor("INPUT_EMAIL"),
    phone: valueFor("INPUT_PHONE_NUMBER")
  };
  const submissionId = event.data?.submissionId;

  if (submissionId && lead.name && lead.email) {
    await deliveryQueue.send({ submissionId, lead });
  }
  return res.sendStatus(204);
});

export async function deliverTallyLead({ submissionId, lead }) {
  const response = await fetch(
    "https://leadproof.jessesay.chatgpt.site/api/v1/leads",
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.LEADPROOF_API_KEY}`,
        "Content-Type": "application/json",
        "Idempotency-Key": submissionId
      },
      body: JSON.stringify({
        destination: process.env.CRM_WEBHOOK_URL,
        ...lead,
        source: "tally_form_response"
      })
    }
  );

  if (!response.ok) throw new Error("Lead delivery failed");
  const delivery = await response.json();
  await persistReceipt(submissionId, delivery.receipt?.id);
}