راهنمای استفاده از نهنگ‌ رادار

{
  "id": "evt_6f1c2b9e-1d4a-4c55-9a51-2f0f4f8d7a10",
  "event": "whale.position.closed",
  "createdAt": "2026-10-03T08:15:04.120Z",
  "data": {
    "activityId": "cmg9x1k2p0001",
    "address": "0x5b5d51203a0f9079f8aeb098a6523a13f298c060",
    "whaleName": "Whale #1",
    "asset": "BTC",
    "side": "LONG",
    "size": 12.5,
    "positionValue": 812500,
    "leverage": 10,
    "entryPrice": 65000,
    "exitPrice": 66200,
    "pnl": 15000,
    "pnlPercent": 18.46,
    "importance": 4,
    "detectedAt": "2026-10-03T08:15:03.870Z"
  }
}

import crypto from 'node:crypto'
import express from 'express'

const app = express()
const SECRET = process.env.NAHANG_WEBHOOK_SECRET // whsec_...

// The signature covers the raw body, so read it unparsed
app.post('/hooks/nahang', express.raw({ type: 'application/json' }), (req, res) => {
  const timestamp = req.get('X-NahangRadar-Timestamp') ?? ''
  const signature = req.get('X-NahangRadar-Signature') ?? ''
  const expected =
    'sha256=' +
    crypto.createHmac('sha256', SECRET).update(`${timestamp}.${req.body}`).digest('hex')

  const valid =
    signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
  // Refuse replays: the timestamp is signed, so an old request can't be refreshed
  const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) < 5 * 60
  if (!valid || !fresh) return res.sendStatus(401)

  const { id, event, data } = JSON.parse(req.body)
  console.log(id, event, data)
  res.sendStatus(200) // answer 2xx within 10 seconds
})

app.listen(3000)