Webhooks

const crypto = require('crypto');

function verifyWebhookSignature(payload, signatureHeader, secret) {
  const parts = signatureHeader.split(',');
  const timestampPart = parts.find(p => p.startsWith('t='));
  const signaturePart = parts.find(p => p.startsWith('v1='));
  
  if (!timestampPart || !signaturePart) return false;
  
  const timestamp = timestampPart.slice(2);
  const providedSignature = signaturePart.slice(3);
  
  // Check timestamp is within 5 minutes
  const timestampNum = parseInt(timestamp, 10);
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - timestampNum) > 300) return false;
  
  // Verify signature
  const signedPayload = `${timestamp}.${JSON.stringify(payload)}`;
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');
  
  return crypto.timingSafeEqual(
    Buffer.from(providedSignature),
    Buffer.from(expectedSignature)
  );
}

// Express webhook handler
app.post('/webhooks/chidori', express.json(), (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  
  if (!verifyWebhookSignature(req.body, signature, WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }
  
  const { event, data } = req.body;
  console.log(`Delivery ${data.deliveryId} status: ${data.status}`);
  
  // Process asynchronously
  processStatusChange(data).catch(console.error);
  
  res.status(200).send('OK');
});

import hmac
import hashlib
import json
import time

def verify_webhook_signature(payload, signature_header, secret):
    parts = dict(p.split('=', 1) for p in signature_header.split(','))
    
    timestamp = parts.get('t')
    provided_signature = parts.get('v1')
    
    if not timestamp or not provided_signature:
        return False
    
    # Check timestamp is within 5 minutes
    timestamp_num = int(timestamp)
    now = int(time.time())
    if abs(now - timestamp_num) > 300:
        return False
    
    # Verify signature
    signed_payload = f"{timestamp}.{json.dumps(payload)}"
    expected_signature = hmac.new(
        secret.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()
    
    return hmac.compare_digest(provided_signature, expected_signature)

# Flask webhook handler
@app.route('/webhooks/chidori', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Webhook-Signature')
    
    if not verify_webhook_signature(request.json, signature, WEBHOOK_SECRET):
        return 'Invalid signature', 401
    
    data = request.json.get('data')
    print(f"Delivery {data['deliveryId']} status: {data['status']}")
    
    return 'OK', 200