Receive webhooks

// app/api/hooks/bins/route.ts in a Next.js app: the endpoint a bin sensor platform pushes to.
import { z } from "zod";
import { connectSource } from "@klorad/api/integration";
import { createScene } from "@klorad/api/world";
import { webhookSource } from "@klorad/protocols";

const scene = createScene({ coordinateSystem: { origin: { lat: 40.62637, lon: 22.94838 } } });
scene.add({ id: "bin-n1", name: "Bin N1", position: { east: -30, north: 70 }, correspondence: "shadow", binding: { source: "bins", entity: "n1" } });

const Push = z.object({ device: z.string(), fill: z.number().min(0).max(100), measuredAt: z.string().datetime() });

const bins = webhookSource({
  id: "bins",
  secret: () => process.env.BINS_WEBHOOK_SECRET ?? "",
  parse: (body) => {
    const push = Push.parse(body);
    return [{ entity: push.device, quantity: "fill", value: push.fill, unit: "%", observedAt: Date.parse(push.measuredAt) }];
  },
});
connectSource(scene, bins);

// 202 when accepted; 401 for a bad signature or a stale timestamp; 400 when parse refuses the body.
export const POST = (request: Request) => bins.handle(request);

import { signWebhook } from "@klorad/protocols";

// What a sender does: sign `timestamp.body` with the shared secret and send both headers.
export async function sendFill(secret: string, fill: number) {
  const body = JSON.stringify({ device: "n1", fill, measuredAt: new Date().toISOString() });
  const timestamp = Date.now();
  return fetch("https://twin.example.com/api/hooks/bins", {
    method: "POST",
    headers: {
      "content-type": "application/json",
      "x-klorad-timestamp": String(timestamp),
      "x-klorad-signature": await signWebhook(secret, timestamp, body),
    },
    body,
  });
}