Give every Wix form automation a verifiable CRM delivery outcome.

import crypto from "node:crypto";

app.post("/wix/form/:ingressToken", express.json({ limit: "32kb" }), async (req, res) => {
  const expected = process.env.WIX_INGRESS_TOKEN;
  const supplied = req.params.ingressToken;
  if (!expected || !supplied) return res.sendStatus(401);

  const expectedBytes = Buffer.from(expected);
  const suppliedBytes = Buffer.from(supplied);
  const authentic =
    expectedBytes.length === suppliedBytes.length &&
    crypto.timingSafeEqual(expectedBytes, suppliedBytes);
  if (!authentic) return res.sendStatus(401);

  const { event_id: eventId, name, email, phone } = req.body;
  if (!eventId || !name || !email) {
    return res.status(422).json({ error: "Missing approved lead fields" });
  }

  const response = await fetch(
    "https://leadproof.jessesay.chatgpt.site/api/v1/leads",
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.LEADPROOF_API_KEY}`,
        "Content-Type": "application/json",
        "Idempotency-Key": eventId
      },
      body: JSON.stringify({
        destination: process.env.CRM_WEBHOOK_URL,
        name,
        email,
        phone,
        source: "wix_form"
      })
    }
  );

  const delivery = await response.json();
  if (!response.ok) return res.status(502).json({ status: "delivery_failed" });
  return res.json({
    status: delivery.status,
    receipt_id: delivery.receipt?.id
  });
});