Turn App Store and Google Play reviews into GitHub issues

{
  "delivery_id": "…",
  "event": "review.negative",
  "events": ["review.created", "review.negative"],
  "created_at": "2026-10-13T08:00:00.000Z",
  "test": false,
  "review": {
    "id": "3f9c2b1e-…",
    "rating": 2,
    "title": "Sync broke",
    "content": "Sync stopped working after the latest update.",
    "author_name": "Alex M.",
    "posted_at": "2026-10-13T07:51:00.000Z",
    "sentiment": "negative",
    "app_version": "4.2.0",
    "country": "US",
    "url": "https://…"
  },
  "property": { "id": "8a71d0c4-…", "name": "Acme Notes", "type": "google-play", "external_id": "com.acme.notes", "icon_url": null, "store_url": "https://…" },
  "links": { "review_url": "https://review.expert/admin/…" }
}

import crypto from "node:crypto";
import http from "node:http";

const SECRET = process.env.REVIEWEXPERT_WEBHOOK_SECRET;
const seen = new Set(); // use a database in production

function verify(raw, headers) {
  const ts = Number(headers["x-reviewexpert-timestamp"]);
  const sig = String(headers["x-reviewexpert-signature"] || "");
  if (!Number.isInteger(ts) || Math.abs(Date.now() / 1000 - ts) > 300) return false;
  const expected = "v1=" + crypto.createHmac("sha256", SECRET).update(ts + "." + raw).digest("hex");
  return sig.split(",").some((s) => s.trim().length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(s.trim()), Buffer.from(expected)));
}

// GitHub REST API. GITHUB_TOKEN: a fine-grained token with "Issues: write" on GITHUB_REPO only.
async function createIssue(title, body) {
  const res = await fetch(`https://api.github.com/repos/${process.env.GITHUB_REPO}/issues`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.GITHUB_TOKEN}`,
      Accept: "application/vnd.github+json",
      "X-GitHub-Api-Version": "2022-11-28",
    },
    body: JSON.stringify({ title: title.slice(0, 250), body, labels: ["app-review"] }),
  });
  return res.ok;
}

http.createServer(async (req, res) => {
  let raw = "";
  for await (const chunk of req) raw += chunk;
  if (req.method !== "POST" || !verify(raw, req.headers)) return res.writeHead(401).end();
  const delivery = req.headers["x-reviewexpert-delivery"];
  if (seen.has(delivery)) return res.writeHead(200).end();
  const { review, property, links } = JSON.parse(raw);
  const title = `[${property.name}] ${review.rating}★ ${review.title ?? (review.content ?? "").slice(0, 60)}`;
  const body = [
    review.content ?? "(no text)",
    "",
    `Rating: ${review.rating}/5 · Version: ${review.app_version ?? "n/a"} · Country: ${review.country ?? "n/a"}`,
    `Review in Review Expert: ${links.review_url}`,
  ].join("\n");
  const ok = await createIssue(title, body);
  if (ok) seen.add(delivery);
  res.writeHead(ok ? 200 : 502).end(); // a non-2xx makes Review Expert retry
}).listen(process.env.PORT || 8080);