Send email from Ruby.

require "json"
require "net/http"
require "uri"

# One key for the whole retry loop, so three attempts can only ever produce
# one email. A different body with the same key answers 409 NOT_UNIQUE.
def post_email(payload, idempotency_key, attempts: 3)
  uri = URI("https://app.usenotix.dev/api/v1/emails")
  attempts.times do |attempt|
    request = Net::HTTP::Post.new(uri)
    request["Authorization"] = "Bearer #{ENV.fetch("NOTIX_API_KEY")}"
    request["Content-Type"] = "application/json"
    request["Idempotency-Key"] = idempotency_key
    request.body = payload.to_json

    response = Net::HTTP.start(uri.host, uri.port, use_ssl: true, open_timeout: 5, read_timeout: 15) do |http|
      http.request(request)
    end

    return JSON.parse(response.body) if response.is_a?(Net::HTTPSuccess)

    # 429 carries Retry-After; 5xx is worth a retry; 4xx is not.
    retryable = response.code == "429" || response.code.start_with?("5")
    raise "Notix #{response.code}: #{response.body}" unless retryable && attempt < attempts - 1

    sleep((response["Retry-After"] || 2 ** attempt).to_i)
  rescue Net::OpenTimeout, Net::ReadTimeout
    raise if attempt == attempts - 1
    sleep(2 ** attempt)
  end
end

# config.ru: a Rack app that verifies and handles Notix webhooks.
require "json"
require "openssl"
require "rack"

SECRET = ENV.fetch("NOTIX_WEBHOOK_SECRET") # starts with whsec_
TOLERANCE_MS = 5 * 60 * 1000

app = lambda do |env|
  request = Rack::Request.new(env)
  return [404, {}, ["not found"]] unless request.post? && request.path == "/webhooks/notix"

  raw_body = request.body.read              # the exact bytes, never re-encoded
  timestamp = request.get_header("HTTP_X_NOTIX_TIMESTAMP").to_s
  signature = request.get_header("HTTP_X_NOTIX_SIGNATURE").to_s

  # Replay protection: the timestamp is milliseconds since the epoch.
  now_ms = (Time.now.to_f * 1000).to_i
  return [400, {}, ["stale"]] if (now_ms - timestamp.to_i).abs > TOLERANCE_MS

  expected = "v1=" + OpenSSL::HMAC.hexdigest("SHA256", SECRET, "#{timestamp}.#{raw_body}")
  return [400, {}, ["bad signature"]] unless Rack::Utils.secure_compare(expected, signature)

  event = JSON.parse(raw_body)
  case event["type"]
  when "email.delivered" then Orders.mark_receipt_delivered(event.dig("data", "id"))
  when "email.bounced"   then Users.mark_email_invalid(event.dig("data", "to"))
  end

  [200, { "content-type" => "text/plain" }, ["ok"]]
end

run app