SMS and WhatsApp to parents on absence

// sms-on-absence.mjs: a webhook endpoint for student.absent and student.late (Node 18+, Express)
import crypto from "node:crypto"
import express from "express"

const SECRET = process.env.SCHOOL360_WEBHOOK_SECRET // whsec_…
const GATEWAY = process.env.SMS_GATEWAY_URL // your SMS / WhatsApp provider's send address
const seen = new Set() // use a database table in production

const verified = (header = "", body) => {
  const p = Object.fromEntries(header.split(",").map((x) => x.split("=", 2)))
  const expected = crypto.createHmac("sha256", SECRET).update(`${p.t}.${body}`).digest("hex")
  return p.v1?.length === expected.length && crypto.timingSafeEqual(Buffer.from(p.v1), Buffer.from(expected)) && Math.abs(Date.now() / 1000 - Number(p.t)) < 300
}
// 0300-1234567 → 923001234567
const msisdn = (phone) => phone.replace(/\D/g, "").replace(/^0/, "92")

const app = express()
app.post("/school360/attendance", express.raw({ type: "application/json" }), (req, res) => {
  const body = req.body.toString("utf8")
  if (!verified(req.get("School360-Signature"), body)) return res.status(400).end()
  const delivery = req.get("School360-Delivery")
  res.sendStatus(204) // answer within 10 s; send the SMS afterwards
  if (seen.has(delivery)) return // a retry or a Resend: already texted
  seen.add(delivery)

  const { event, school, data } = JSON.parse(body)
  if (!data.family?.phone) return
  const name = `${data.student.firstName} ${data.student.lastName}`.trim()
  const text =
    event === "student.absent"
      ? `${name} (${data.student.className} ${data.student.sectionName}) is absent today, ${data.date}. Please inform the school if this is unexpected. — ${school.name}`
      : `${name} arrived late today, ${data.date}. — ${school.name}`
  fetch(GATEWAY, {
    method: "POST",
    headers: { "Content-Type": "application/json", Authorization: `Bearer ${process.env.SMS_GATEWAY_KEY}` },
    body: JSON.stringify({ to: msisdn(data.family.phone), text }),
  }).catch((err) => console.error("SMS failed", delivery, err.message))
})

app.listen(3000)

<?php
// sms-on-absence.php: a webhook endpoint for student.absent and student.late
$secret = getenv('SCHOOL360_WEBHOOK_SECRET');           // whsec_…
$gateway = getenv('SMS_GATEWAY_URL');                    // your SMS / WhatsApp provider's send address
$seenDir = __DIR__ . '/seen';                            // one empty file per delivery handled

$body = file_get_contents('php://input');
parse_str(str_replace(',', '&', $_SERVER['HTTP_SCHOOL360_SIGNATURE'] ?? ''), $sig);
$expected = hash_hmac('sha256', ($sig['t'] ?? '') . '.' . $body, $secret);
if (!hash_equals($expected, $sig['v1'] ?? '') || abs(time() - (int) ($sig['t'] ?? 0)) > 300) {
    http_response_code(400);
    exit;
}

// A retry or a Resend of something already texted: say yes and stop
$delivery = preg_replace('/[^a-f0-9-]/', '', $_SERVER['HTTP_SCHOOL360_DELIVERY'] ?? '');
@mkdir($seenDir);
if ($delivery === '' || !@fopen("$seenDir/$delivery", 'x')) {
    http_response_code(204);
    exit;
}

$event = json_decode($body, true);
$data = $event['data'];
$phone = preg_replace('/^0/', '92', preg_replace('/\D/', '', $data['family']['phone'] ?? ''));
$name = trim($data['student']['firstName'] . ' ' . $data['student']['lastName']);
$text = $event['event'] === 'student.absent'
    ? "$name ({$data['student']['className']} {$data['student']['sectionName']}) is absent today, {$data['date']}. — {$event['school']['name']}"
    : "$name arrived late today, {$data['date']}. — {$event['school']['name']}";

// Answer School360 first (it waits at most 10 s), then call the gateway
http_response_code(204);
if (function_exists('fastcgi_finish_request')) fastcgi_finish_request();

if ($phone !== '') {
    $ch = curl_init($gateway);
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 20,
        CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'Authorization: Bearer ' . getenv('SMS_GATEWAY_KEY')],
        CURLOPT_POSTFIELDS => json_encode(['to' => $phone, 'text' => $text]),
    ]);
    curl_exec($ch);
    curl_close($ch);
}