Webhook Integration

{
  "event_id": "a1b2c3d4e5f6...",
  "event": "article.ready",
  "timestamp": "2026-05-05T14:30:15.000Z",
  "site": {
    "id": "site_abc123",
    "name": "My Site",
    "host": "https://example.com"
  },
  "article": {
    "id": "art_xyz789",
    "slug": "how-to-build-better-content",
    "title": "How to Build Better Content",
    "content": "<h1>How to Build Better Content</h1><p>...</p>",
    "summary": "Learn how to build better content with this guide.",
    "seo_title": "How to Build Better Content | My Site",
    "seo_meta_description": "Learn how to build better content...",
    "target_keyword": "build better content",
    "main_image_url": "https://cdn.sightai.io/images/main.jpg",
    "thumbnail_image_url": "https://cdn.sightai.io/images/thumb.jpg",
    "article_type": "explainer",
    "category": "Content Marketing",
    "author_name": "Sight AI",
    "read_time_minutes": 5,
    "is_featured": false,
    "published_at": null,
    "created_at": "2026-05-05T12:00:00.000Z",
    "updated_at": "2026-05-05T14:30:15.000Z"
  }
}

import crypto from 'crypto';

function verifySignature(rawBody: string, signatureHeader: string, secret: string): boolean {
  if (!signatureHeader || !signatureHeader.startsWith('sha256=')) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody, 'utf8')
    .digest('hex');

  const provided = signatureHeader.slice('sha256='.length);

  // Both buffers must be the same length for timingSafeEqual.
  if (expected.length !== provided.length) return false;

  return crypto.timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(provided, 'hex'),
  );
}

import { revalidatePath, revalidateTag } from 'next/cache';

revalidatePath(`/blog/${article.slug}`);
revalidatePath('/blog');
if (article.category) {
  revalidatePath(`/topics/${slugify(article.category)}`);
}
revalidateTag(`article:${article.id}`);

// app/api/webhooks/sight-ai/route.ts
import { NextResponse } from 'next/server';
import { revalidatePath, revalidateTag } from 'next/cache';
import crypto from 'node:crypto';
import { db } from '@/lib/db'; // your DB client (Prisma, Drizzle, raw, …)

const REPLAY_WINDOW_MS = 5 * 60 * 1000; // 5 minutes

export async function GET() {
  // Useful for uptime monitors and "is this deployed?" checks.
  return NextResponse.json({ status: 'ok', endpoint: 'sight-ai' });
}

export async function POST(request: Request) {
  const secret =
    process.env.SIGHT_AI_WEBHOOK_SECRET ?? process.env.SIGHTAI_WEBHOOK_SECRET;

  if (!secret) {
    return NextResponse.json(
      { error: 'Webhook not configured' },
      { status: 503 },
    );
  }

  // 1. Read the RAW body — required for signature verification.
  const rawBody = await request.text();

  // 2. Verify the signature.
  const signature = request.headers.get('x-sightai-signature') ?? '';
  if (!verifySignature(rawBody, signature, secret)) {
    return NextResponse.json({ error: 'Invalid signature' }, { status: 401 });
  }

  // 3. Verify the timestamp (replay protection).
  const timestampHeader = request.headers.get('x-sightai-timestamp');
  const timestamp = Number(timestampHeader);
  if (
    !Number.isFinite(timestamp) ||
    Math.abs(Date.now() - timestamp) > REPLAY_WINDOW_MS
  ) {
    return NextResponse.json(
      { error: 'Timestamp too old or in future' },
      { status: 401 },
    );
  }

  // 4. Parse and validate the payload.
  let payload: SightAiWebhookPayload;
  try {
    payload = JSON.parse(rawBody);
  } catch {
    return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 });
  }

  const { article, event_id } = payload;
  if (!article?.id || !article.slug || !article.title || !article.content) {
    return NextResponse.json(
      { error: 'Missing required article fields' },
      { status: 400 },
    );
  }

  // 5. Idempotency: if we've already processed this event_id, no-op.
  if (event_id && (await db.webhookEvent.exists({ event_id }))) {
    return NextResponse.json({ ok: true, deduped: true });
  }

  // 6. Upsert by article.id (NOT slug — slugs can change).
  const existing = await db.article.findByExternalId(article.id);

  const data = {
    external_id: article.id,            // store this — it's your upsert key
    slug: article.slug,                  // may have changed since last delivery
    title: article.title,
    content_html: article.content,
    summary: article.summary ?? null,
    seo_title: article.seo_title ?? null,
    seo_description: article.seo_meta_description ?? null,
    main_image_url: article.main_image_url ?? null,
    thumbnail_image_url: article.thumbnail_image_url ?? null,
    category: article.category ?? null,
    author_name: article.author_name ?? null,
    read_time_minutes: article.read_time_minutes ?? null,
    is_featured: article.is_featured,
    published_at: article.published_at ?? new Date().toISOString(),
    sight_updated_at: article.updated_at,
  };

  const operation = existing ? 'updated' : 'created';
  if (existing) {
    await db.article.update(existing.id, data);
  } else {
    await db.article.create(data);
  }

  if (event_id) {
    await db.webhookEvent.record({ event_id, article_id: article.id });
  }

  // 7. Bust caches so the live site reflects the new content immediately.
  try {
    revalidatePath(`/blog/${article.slug}`);
    revalidatePath('/blog');
    if (existing && existing.slug !== article.slug) {
      revalidatePath(`/blog/${existing.slug}`); // old URL when slug changed
    }
    revalidateTag(`article:${article.id}`);
  } catch (err) {
    console.warn('[sight-ai] revalidation failed (ISR will recover)', err);
  }

  return NextResponse.json({
    ok: true,
    operation,
    article_id: article.id,
    slug: article.slug,
  });
}

function verifySignature(rawBody: string, header: string, secret: string) {
  if (!header.startsWith('sha256=')) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody, 'utf8')
    .digest('hex');

  const provided = header.slice('sha256='.length);
  if (expected.length !== provided.length) return false;

  return crypto.timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(provided, 'hex'),
  );
}

type SightAiWebhookPayload = {
  event_id?: string;
  event: 'article.ready' | string;
  timestamp: string;
  site: { id: string; name: string; host: string };
  article: {
    id: string;
    slug: string;
    title: string;
    content: string;
    summary?: string | null;
    seo_title?: string | null;
    seo_meta_description?: string | null;
    target_keyword?: string | null;
    main_image_url?: string | null;
    thumbnail_image_url?: string | null;
    article_type: string;
    category?: string | null;
    author_name?: string | null;
    read_time_minutes?: number | null;
    is_featured: boolean;
    published_at?: string | null;
    created_at: string;
    updated_at: string;
  };
};

if (payload.test === true) {
  return NextResponse.json({ ok: true, test: true });
}

SECRET='your-shared-secret'
TS=$(($(date +%s) * 1000))
BODY='{"event_id":"manual-test","event":"article.ready","timestamp":"2026-05-05T14:30:15.000Z","site":{"id":"s","name":"S","host":"https://example.com"},"article":{"id":"art_local_test","slug":"hello","title":"Hello","content":"<p>Hello</p>","article_type":"explainer","is_featured":false,"created_at":"2026-05-05T14:30:15.000Z","updated_at":"2026-05-05T14:30:15.000Z"}}'
SIG="sha256=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$SECRET" -hex | awk '{print $2}')"

curl -i -X POST https://yourdomain.com/api/webhooks/sight-ai \
  -H 'Content-Type: application/json' \
  -H "X-SightAI-Signature: $SIG" \
  -H "X-SightAI-Timestamp: $TS" \
  -H 'X-SightAI-Version: 1.0' \
  --data "$BODY"