Webhooks

const express = require('express');
const crypto = require('crypto');

const app = express();
app.use(express.text({ type: '*/*' }));

const SECRET_KEY = process.env.SAHHA_WEBHOOK_SECRET;

app.post('/webhook', (req, res) => {
	const signature = req.get('X-Signature');
	const externalId = req.get('X-External-Id');
	const eventType = req.get('X-Event-Type');

	// Validate headers
	if (!signature || !externalId || !eventType) {
		return res.status(400).json({ error: 'Missing required headers' });
	}

	// Verify signature
	const hmac = crypto.createHmac('sha256', SECRET_KEY);
	const computed = hmac.update(req.body).digest('hex');
	if (signature.toLowerCase() !== computed.toLowerCase()) {
		return res.status(401).json({ error: 'Invalid signature' });
	}

	// Process event (do heavy work async to respond quickly)
	const payload = JSON.parse(req.body);
	processEventAsync(eventType, externalId, payload);

	res.status(200).json({ received: true });
});

app.listen(3000);

from flask import Flask, request, jsonify
import hmac
import hashlib
import os

app = Flask(__name__)
SECRET_KEY = os.environ.get('SAHHA_WEBHOOK_SECRET')

@app.route('/webhook', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Signature')
    external_id = request.headers.get('X-External-Id')
    event_type = request.headers.get('X-Event-Type')

    # Validate headers
    if not all([signature, external_id, event_type]):
        return jsonify({'error': 'Missing required headers'}), 400

    # Verify signature
    payload = request.get_data()
    computed = hmac.new(
        SECRET_KEY.encode('utf-8'),
        payload,
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(signature.lower(), computed.lower()):
        return jsonify({'error': 'Invalid signature'}), 401

    # Process event (do heavy work async to respond quickly)
    data = request.get_json()
    process_event_async(event_type, external_id, data)

    return jsonify({'received': True}), 200

if __name__ == '__main__':
    app.run(port=3000)

[ApiController]
[Route("[controller]")]
public class WebhookController : ControllerBase
{
    private readonly string _secretKey;

    public WebhookController(IConfiguration config)
    {
        _secretKey = config["Sahha:WebhookSecret"];
    }

    [HttpPost]
    public async Task<IActionResult> HandleWebhook()
    {
        var signature = Request.Headers["X-Signature"].ToString();
        var externalId = Request.Headers["X-External-Id"].ToString();
        var eventType = Request.Headers["X-Event-Type"].ToString();

        // Validate headers
        if (string.IsNullOrEmpty(signature) ||
            string.IsNullOrEmpty(externalId) ||
            string.IsNullOrEmpty(eventType))
        {
            return BadRequest(new { error = "Missing required headers" });
        }

        // Verify signature
        var payload = await new StreamReader(Request.Body).ReadToEndAsync();
        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(_secretKey));
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(payload));
        var computed = BitConverter.ToString(hash).Replace("-", "").ToLower();

        if (!signature.Equals(computed, StringComparison.OrdinalIgnoreCase))
        {
            return Unauthorized(new { error = "Invalid signature" });
        }

        // Process event (do heavy work async to respond quickly)
        _ = ProcessEventAsync(eventType, externalId, payload);

        return Ok(new { received = true });
    }
}