Webhooks & events

import crypto from "node:crypto";
import express from "express";

const app = express();
app.post("/arenyze", express.raw({ type: "application/json" }), (req, res) => {
  const sig = req.get("Arenyze-Signature") || "";
  const { t, v1 } = Object.fromEntries(sig.split(",").map(p => p.split("=")));
  const expected = crypto.createHmac("sha256", process.env.ARENYZE_WEBHOOK_SECRET)
    .update(`${t}.${req.body}`).digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(t)) < 300;
  if (!fresh || !v1 || !crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected))) {
    return res.status(400).send("bad signature");
  }
  const event = JSON.parse(req.body);
  console.log(event.type, event.text);
  res.sendStatus(204); // answer fast; do the work async
});

import hmac, hashlib, os, time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["ARENYZE_WEBHOOK_SECRET"].encode()

@app.post("/arenyze")
def arenyze():
    parts = dict(p.split("=", 1) for p in request.headers.get("Arenyze-Signature", "").split(","))
    body = request.get_data()
    expected = hmac.new(SECRET, f"{parts.get('t')}.".encode() + body, hashlib.sha256).hexdigest()
    if abs(time.time() - int(parts.get("t", 0))) > 300 or not hmac.compare_digest(expected, parts.get("v1", "")):
        abort(400)
    event = request.get_json()
    print(event["type"], event["text"])
    return "", 204