Recepción de Resultados vía Webhook y Validación HMAC

import { createHmac, timingSafeEqual } from "node:crypto";
import type { Request, Response, NextFunction } from "express";

export function verifyQliniWebhook(req: Request, res: Response, next: NextFunction) {
  const signature = req.headers["x-qlini-signature"] as string;
  const timestamp = req.headers["x-qlini-timestamp"] as string;
  const secret = process.env.QLINI_WEBHOOK_SECRET;

  if (!signature || !timestamp || !secret) {
    return res.status(401).json({ error: "Firma o cabeceras faltantes" });
  }

  // 1. Prevenir ataques de replay (tolerancia de 5 minutos)
  const eventTime = new Date(timestamp).getTime();
  if (Math.abs(Date.now() - eventTime) > 5 * 60 * 1000) {
    return res.status(400).json({ error: "Timestamp fuera de tolerancia" });
  }

  // 2. Calcular HMAC sobre timestamp.rawBody
  const rawBody = (req as any).rawBody || JSON.stringify(req.body);
  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const received = signature.replace(/^sha256=/, "");

  // 3. Comparación en tiempo constante para evitar ataques de timing
  const isValid =
    expected.length === received.length &&
    timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(received, "hex"));

  if (!isValid) {
    return res.status(401).json({ error: "Firma HMAC inválida" });
  }

  next();
}

{
  "eventId": "evt_01928374-65ab-7c8d-9e0f-123456789abc",
  "sessionId": "cs_01928374-65ab-7c8d-9e0f",
  "externalEncounterId": "enc-2026-000456",
  "externalClientId": "sede-norte-bogota",
  "template": {
    "code": "medicina-general-adultos",
    "version": 2
  },
  "transcript": "Paciente refiere cefalea de 3 días...",
  "templateData": {
    "motivo_consulta": "Cefalea holocraneana de 3 días de evolución",
    "enfermedad_actual": "Cuadro clínico de inicio insidioso...",
    "presion_arterial": "120/80",
    "frecuencia_cardiaca": 72
  },
  "positivos": [
    { "campo": "motivo_consulta", "evidencia": "cefalea holocraneana de 3 días" }
  ],
  "clinicalPlan": {
    "posiblesDiagnosticos": [
      { "codigoCie": "G44.2", "nombre": "Cefalea tensional", "tipo": "PRESUNTIVO" }
    ],
    "medicamentos": [
      { "nombre": "Acetaminofén", "dosis": "500 mg cada 8 horas por 3 días" }
    ],
    "ordenesMedicas": []
  }
}