Zapier

// Railbed → Zapier: check a webhook's signature, then turn the event into simple fields.
//
// Paste this whole file into a "Code by Zapier → Run JavaScript" step that follows
// "Webhooks by Zapier → Catch Raw Hook". Fill in the step's Input Data:
//
//   raw_body         Catch Raw Hook's "Raw Body"
//   signature        Catch Raw Hook's Railbed-Signature header ("Headers Http Railbed Signature")
//   secret           the endpoint's signing secret from Railbed (whsec_…)
//   max_age_seconds  optional; how old a delivery may be, in seconds (default 3600)
//
// A delivery whose signature doesn't match stops the Zap with an error, so nothing after
// this step runs for it. Guide: https://railbed.com/docs/guides/zapier/

const crypto = require('crypto');

const rawBody = typeof inputData.raw_body === 'string' ? inputData.raw_body : '';
const header = String(inputData.signature || '').trim();
const secret = String(inputData.secret || '').trim();
const maxAge = inputData.max_age_seconds ? Number(inputData.max_age_seconds) : 3600;

if (!/^whsec_[A-Za-z0-9_-]+$/.test(secret)) {
  throw new Error('Add the endpoint\'s signing secret (it starts with whsec_) to this step\'s "secret" input.');
}
if (!Number.isFinite(maxAge) || maxAge <= 0) {
  throw new Error('max_age_seconds must be a number of seconds, such as 3600.');
}

// Railbed-Signature: t=<Unix seconds>,v1=<hex HMAC>[,v1=<hex HMAC>] (two v1 values for 24 hours after a secret roll).
const match = /^t=(\d{1,12})((?:,v1=[0-9a-f]{64})+)$/.exec(header);
if (!match) {
  throw new Error('This request has no valid Railbed-Signature header, so it was not sent by Railbed. Nothing after this step ran.');
}
const timestamp = match[1];
const age = Math.abs(Date.now() / 1000 - Number(timestamp));
if (age > maxAge) {
  throw new Error(`This delivery was signed ${Math.round(age)} seconds ago, longer than max_age_seconds (${maxAge}). Check the payment in Railbed, or resend the delivery from Developers.`);
}
const expected = Buffer.from(crypto.createHmac('sha256', secret).update(`${timestamp}.${rawBody}`, 'utf8').digest('hex'));
const genuine = match[2].slice(1).split(',').some((part) => {
  const given = Buffer.from(part.slice(3));
  return given.length === expected.length && crypto.timingSafeEqual(expected, given);
});
if (!genuine) {
  throw new Error('The Railbed-Signature doesn\'t match this body and secret. Check that the secret belongs to this endpoint and mode (Test and Live differ), and that "raw_body" is mapped from Catch Raw Hook. Nothing after this step ran.');
}

const event = JSON.parse(rawBody);
const data = event.data || {};
const payment = data.payment || null;
const order = data.order || null;
const customer = data.customer || null;
const iso = (ms) => (typeof ms === 'number' ? new Date(ms).toISOString() : null);
const address = (prefix, a) => ({
  [`${prefix}_name`]: a ? a.name : null,
  [`${prefix}_line1`]: a ? a.line1 : null,
  [`${prefix}_line2`]: a ? a.line2 : null,
  [`${prefix}_city`]: a ? a.city : null,
  [`${prefix}_region`]: a ? a.region : null,
  [`${prefix}_postal_code`]: a ? a.postalCode : null,
  [`${prefix}_country`]: a ? a.country : null,
});

return {
  verified: true,
  event_id: event.id,
  event_type: event.type,
  event_created_at: typeof event.created === 'number' ? new Date(event.created * 1000).toISOString() : null,
  mode: event.livemode ? 'live' : 'test',
  // Send test event in Developers uses a made-up payment that the API doesn't know.
  is_sample: !!(payment && payment.metadata && payment.metadata.sample === 'true'),

  payment_id: payment ? payment.id : null,
  payment_status: payment ? payment.status : null,
  amount: payment ? payment.amount : null,
  currency: payment ? payment.currency : null,
  description: payment ? payment.description : null,
  reference: payment ? payment.reference : null,
  customer_email: payment ? payment.customerEmail : null,
  provider: payment ? payment.provider : null,
  provider_name: payment ? payment.providerName : null,
  method: payment ? payment.method : null,
  hold_reason: payment ? payment.holdReason : null,
  hold_acceptable: payment ? !!payment.holdAcceptable : null,
  net_received: payment ? payment.merchantReceived : null,
  checkout_url: payment ? payment.url : null,
  created_at: payment ? iso(payment.createdAt) : null,
  paid_at: payment ? iso(payment.paidAt) : null,
  metadata: payment && payment.metadata ? payment.metadata : {},

  order_id: order ? order.id : null,
  order_number: order ? order.displayNumber : null,
  order_status: order ? order.status : null,
  order_needs_review: order ? !!order.needsReview : null,
  order_fulfillment: order ? order.fulfillment : null,
  order_summary: order ? order.summary : null,
  order_subtotal: order ? order.subtotal : null,
  order_discount: order ? order.discount : null,
  order_shipping: order ? order.shipping : null,
  order_tax: order ? order.tax : null,
  order_total: order ? order.total : null,
  order_store_order_id: order && order.store ? order.store.orderId : null,
  order_items: order && Array.isArray(order.items)
    ? order.items.map((item) => ({
        name: item.name,
        variant: item.variant,
        sku: item.sku,
        quantity: item.quantity,
        unit_amount: item.unitAmount,
        amount: item.amount,
      }))
    : [],
  ...address('shipping', order ? order.shipTo : null),

  customer_id: customer ? customer.id : null,
  customer_name: customer ? customer.name : null,
  customer_phone: customer ? customer.phone : null,
};

{
  "amount": "49.00",
  "currency": "USD",
  "description": "Pro Membership",
  "customer_email": "buyer@example.com",
  "reference": "order_1042",
  "success_url": "https://yourstore.com/thanks"
}

{ "fulfillment": "fulfilled" }

{ "type": "refunded", "id": "refund_5521", "amount": "12.00" }

// Railbed → Zapier: add up the payments that became paid in the last day.
//
// Paste this whole file into a "Code by Zapier → Run JavaScript" step that follows
// "Schedule by Zapier → Every Day". Fill in the step's Input Data:
//
//   secret_key     a Railbed secret key; a Read only key is enough (rb_live_… or rb_test_…)
//   hours          optional; the period to add up, in hours (default 24)
//   lookback_days  optional; how far back to look for payments created earlier and paid in the
//                  period (default 2: checkout sessions stay open 24 hours; raise it if you use
//                  payment links that stay open longer)
//
// Totals are kept per currency and never converted or added across currencies.
// Guide: https://railbed.com/docs/guides/zapier/

const API = 'https://pay.railbed.io/v1';
const MAX_PAGES = 5; // 500 payments; Code steps have a short time limit

const key = String(inputData.secret_key || '').trim();
const hours = inputData.hours ? Number(inputData.hours) : 24;
const lookbackDays = inputData.lookback_days ? Number(inputData.lookback_days) : 2;
if (!/^rb_(live|test)_[A-Za-z0-9_-]+$/.test(key)) {
  throw new Error('Add a Railbed secret key (it starts with rb_live_ or rb_test_) to this step\'s "secret_key" input.');
}
if (!(hours > 0) || !(lookbackDays > 0)) {
  throw new Error('hours and lookback_days must be positive numbers.');
}

const now = Math.floor(Date.now() / 1000);
const periodStart = now - Math.round(hours * 3600);
const createdSince = Math.min(periodStart, now - Math.round(lookbackDays * 86400));

// Decimal strings → whole units of the smallest digit, so nothing is rounded on the way.
const toUnits = (value, places) => {
  const [whole, fraction = ''] = String(value).split('.');
  return BigInt(whole + fraction.padEnd(places, '0').slice(0, places));
};
const fromUnits = (units, places) => {
  const text = units.toString().padStart(places + 1, '0');
  return `${text.slice(0, -places)}.${text.slice(-places)}`;
};

const sales = {}; // currency → cents
let paidCount = 0;
let netMicros = 0n; // dollars received after fees, six decimal places
let netMissing = 0;
let cursor = null;
let pages = 0;
let more = true;
while (more && pages < MAX_PAGES) {
  const params = new URLSearchParams({ status: 'paid', limit: '100', created_gte: String(createdSince) });
  if (cursor) params.set('starting_after', cursor);
  const response = await fetch(`${API}/payments?${params}`, { headers: { Authorization: `Bearer ${key}` } });
  const body = await response.json().catch(() => null);
  if (!response.ok) {
    const reason = body && body.error ? `${body.error.message} (${body.error.code})` : `HTTP ${response.status}`;
    throw new Error(`Railbed didn't return the payments: ${reason}`);
  }
  for (const payment of body.data) {
    if (!payment.paid_at || payment.paid_at < periodStart) continue;
    paidCount += 1;
    sales[payment.currency] = (sales[payment.currency] || 0n) + toUnits(payment.amount, 2);
    const net = payment.settlement && payment.settlement.merchant_received;
    if (net) netMicros += toUnits(net, 6);
    else netMissing += 1;
  }
  pages += 1;
  more = body.has_more;
  cursor = body.next_cursor;
}

const currencies = Object.keys(sales).sort();
const summary = {
  period_start: new Date(periodStart * 1000).toISOString(),
  period_end: new Date(now * 1000).toISOString(),
  paid_count: paidCount,
  sales_summary: currencies.length ? currencies.map((c) => `${fromUnits(sales[c], 2)} ${c}`).join(', ') : 'No paid payments',
  net_received: fromUnits(netMicros, 6),
  net_received_pending: netMissing,
  complete: !more,
};
for (const c of currencies) summary[`sales_${c.toLowerCase()}`] = fromUnits(sales[c], 2);
return summary;