Webhooks

const crypto = require('crypto');

function verifyWebhook(rawBody, signature, timestamp, secret) {
  // 1. Check timestamp is recent (5 min)
  const age = Math.abs(Date.now() - new Date(timestamp).getTime()) / 1000;
  if (age > 300) return false;
  
  // 2. Compute expected signature
  const message = `${timestamp}.${rawBody}`;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(message)
    .digest('hex');
  
  // 3. Compare (constant-time)
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// Express.js example
app.post('/webhooks', express.raw({type: 'application/json'}), (req, res) => {
  const signature = req.headers['x-fieldwise-signature'];
  const timestamp = req.headers['x-fieldwise-timestamp'];
  
  if (!verifyWebhook(req.body.toString(), signature, timestamp, WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }
  
  const event = JSON.parse(req.body);
  console.log('Received:', event.event, event.data.status);
  
  res.status(200).send('OK');
});

import hmac
import hashlib
from datetime import datetime, timezone
from flask import Flask, request

def verify_webhook(payload, signature, timestamp, secret):
    # Check timestamp is recent
    webhook_time = datetime.fromisoformat(timestamp.replace("Z", "+00:00"))
    age = abs((datetime.now(timezone.utc) - webhook_time).total_seconds())
    if age > 300:
        return False
    
    # Compute expected signature
    message = f"{timestamp}.{payload}"
    expected = hmac.new(
        key=secret.encode(),
        msg=message.encode(),
        digestmod=hashlib.sha256
    ).hexdigest()
    
    return hmac.compare_digest(signature, expected)

# Flask example
@app.route('/webhooks', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-FieldWise-Signature')
    timestamp = request.headers.get('X-FieldWise-Timestamp')
    
    if not verify_webhook(request.data.decode(), signature, timestamp, WEBHOOK_SECRET):
        return 'Invalid signature', 401
    
    event = request.json
    print(f"Received: {event['event']} - {event['data']['status']}")
    
    return 'OK', 200