Webhooks

import { createHmac, timingSafeEqual } from 'crypto';
import express from 'express';

const app = express();
app.use(express.raw({ type: 'application/json' }));

app.post('/webhooks/engine', (req, res) => {
  const signature = req.headers['x-webhook-signature'] as string;
  const secret = process.env.WEBHOOK_SECRET!; // whsec_...

  // Calcular HMAC esperado
  const expected = 'sha256=' + createHmac('sha256', secret)
    .update(req.body)
    .digest('hex');

  // Comparação segura contra timing attacks
  const valid = timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );

  if (!valid) {
    return res.status(401).json({ error: 'Assinatura inválida' });
  }

  const { id, type, data } = JSON.parse(req.body.toString());

  // Processar evento
  handleEvent(id, type, data);

  res.status(200).json({ received: true });
});

import hashlib
import hmac
import os
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()

@app.post('/webhooks/engine')
async def handle_webhook(request: Request):
    body = await request.body()
    signature = request.headers.get('x-webhook-signature', '')
    secret = os.environ['WEBHOOK_SECRET'].encode()  # whsec_...

    # Calcular HMAC esperado
    expected = 'sha256=' + hmac.new(secret, body, hashlib.sha256).hexdigest()

    # Comparação segura
    if not hmac.compare_digest(signature, expected):
        raise HTTPException(status_code=401, detail='Assinatura inválida')

    import json
    payload = json.loads(body)
    event_id = payload['id']
    event_type = payload['type']
    data = payload['data']

    # Processar evento
    await process_event(event_id, event_type, data)

    return {'received': True}

$body = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$expected = 'sha256=' . hash_hmac('sha256', $body, getenv('WEBHOOK_SECRET'));
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Assinatura inválida');
}
$event = json_decode($body, true, flags: JSON_THROW_ON_ERROR);
// Deduplicate por $event['id'] antes de processar.

app.post('/webhooks/engine', (req, res) => {
  // ... validação HMAC acima ...

  const { id, type, data } = JSON.parse(req.body.toString());

  // Idempotência: ignore eventos já processados
  if (await isAlreadyProcessed(id)) {
    return res.status(200).json({ received: true });
  }

  switch (type) {
    case 'invoice.authorized':
      await db.invoices.update({
        where: { id: data.invoiceId },
        data: { status: 'AUTHORIZED', accessKey: data.accessKey },
      });
      await notifyCustomer(data.invoiceId);
      break;

    case 'invoice.rejected':
      await db.invoices.update({
        where: { id: data.invoiceId },
        data: { status: 'REJECTED' },
      });
      await alertSupport(data);
      break;

    case 'certificate.expiring':
      await sendEmail({
        to: 'admin@empresa.com',
        subject: `Certificado digital vencendo em ${data.daysUntilExpiry} dia(s)`,
        body: `Renove o certificado do CNPJ ${data.cnpj}`,
      });
      break;
  }

  await markAsProcessed(id);
  res.status(200).json({ received: true });
});

@app.post('/webhooks/engine')
async def handle_webhook(request: Request):
    # ... validação HMAC acima ...

    payload = json.loads(body)
    event_id = payload['id']
    event_type = payload['type']
    data = payload['data']

    # Idempotência
    if await is_already_processed(event_id):
        return {'received': True}

    if event_type == 'invoice.authorized':
        await db.invoices.update(data['invoiceId'], status='AUTHORIZED')
        await notify_customer(data['invoiceId'])

    elif event_type == 'invoice.rejected':
        await db.invoices.update(data['invoiceId'], status='REJECTED')
        await alert_support(data)

    elif event_type == 'certificate.expiring':
        await send_email(
            to='admin@empresa.com',
            subject=f"Certificado vencendo em {data['daysUntilExpiry']} dia(s)",
        )

    await mark_as_processed(event_id)
    return {'received': True}