curl -X PATCH https://api.swaloo.com/api/v1/organizations/{id} \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/merge-patch+json" \
  -d '{"webhookUrl": "https://votre-serveur.com/webhooks/swaloo", "isWebhookEnabled": true}'

{
  "event": "shipment.status_changed",
  "shipmentId": "550e8400-e29b-41d4-a716-446655440000",
  "trackingNumber": "SWL-20260616-A1B2C3",
  "externalReference": "CMD-20260616-001",
  "status": "delivered",
  "taskType": "delivery",
  "taskStatus": "delivered",
  "driverName": "Jean Dupont",
  "updatedAt": "2026-06-16T15:02:00+00:00"
}

1. assign (pickup)       → status: pending,            taskStatus: assigned
2. start_approach        → status: pickup_in_progress, taskStatus: pickup_in_progress
3. pick_up               → status: picked_up,          taskStatus: picked_up
4. assign (delivery)     → status: picked_up,          taskStatus: assigned
5. start_delivery        → status: in_transit,         taskStatus: delivery_in_progress
6. deliver               → status: delivered,          taskStatus: delivered

const crypto = require('crypto');

app.post('/webhooks/swaloo', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.header('X-Swaloo-Signature') || '';
  const expected = 'sha256=' +
    crypto.createHmac('sha256', process.env.SWALOO_WEBHOOK_SECRET)
      .update(req.body).digest('hex');

  const valid = signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

  if (!valid) return res.status(401).end();

  const event = JSON.parse(req.body.toString());
  // Traiter l'evenement (idempotent)...
  res.status(200).json({ received: true });
});

$payload   = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_SWALOO_SIGNATURE'] ?? '';
$expected  = 'sha256=' . hash_hmac('sha256', $payload, getenv('SWALOO_WEBHOOK_SECRET'));

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit;
}

$event = json_decode($payload, true);
// Traiter selon $event['status']...
http_response_code(200);

# 1. Tunnel HTTPS avec ngrok
ngrok http 3000
# → https://abc123.ngrok.io

# 2. Configurer l'URL
curl -X PATCH https://api.swaloo.com/api/v1/organizations/{id} \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/merge-patch+json" \
  -d '{"webhookUrl": "https://abc123.ngrok.io/webhooks/swaloo", "isWebhookEnabled": true}'

# 3. Simuler un webhook manuellement
SECRET="whsec_3f9a8b2c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a"
PAYLOAD='{"event":"shipment.status_changed","shipmentId":"550e8400-...","trackingNumber":"SWL-20260616-A1B2C3","externalReference":"CMD-001","status":"delivered","taskType":"delivery","taskStatus":"delivered","driverName":"Test","updatedAt":"2026-06-16T15:00:00+00:00"}'
SIGNATURE="sha256=$(echo -n "$PAYLOAD" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')"

curl -X POST http://localhost:3000/webhooks/swaloo \
  -H "Content-Type: application/json" \
  -H "X-Swaloo-Signature: $SIGNATURE" \
  -d "$PAYLOAD"