Webhooks

import express from 'express';
import { createHmac, timingSafeEqual } from 'crypto';

const app = express();

function verifySignature(rawBody: Buffer, signature: string, secret: string): boolean {
  const expected = `sha256=${createHmac('sha256', secret).update(rawBody).digest('hex')}`;
  return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

app.post(
  '/webhooks/safravo',
  express.raw({ type: 'application/json' }), // ← raw body required
  (req, res) => {
    const sig = req.headers['x-safravo-signature'] as string;
    if (!verifySignature(req.body, sig, process.env.WEBHOOK_SECRET!)) {
      return res.status(401).send('Invalid signature');
    }

    const event = JSON.parse(req.body.toString());
    console.log('Event:', event.event, event.id);

    res.status(200).json({ received: true });
  },
);

import hashlib
import hmac
import os
from fastapi import FastAPI, Header, HTTPException, Request

app = FastAPI()
WEBHOOK_SECRET = os.environ["WEBHOOK_SECRET"]

def verify_signature(raw_body: bytes, signature: str) -> bool:
    expected = "sha256=" + hmac.new(
        WEBHOOK_SECRET.encode(), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

@app.post("/webhooks/safravo")
async def handle_webhook(
    request: Request,
    x_safravo_signature: str = Header(...),
    x_safravo_event: str = Header(...),
):
    raw_body = await request.body()

    if not verify_signature(raw_body, x_safravo_signature):
        raise HTTPException(status_code=401, detail="Invalid signature")

    event = await request.json()
    print(f"Event: {x_safravo_event} | ID: {event['id']}")

    return {"received": True}

// Laravel — add this route to routes/api.php
// Exclude from CSRF in VerifyCsrfToken middleware
Route::post('/webhooks/safravo', function (Request $request) {
    $rawBody   = $request->getContent();
    $signature = $request->header('X-Safravo-Signature');
    $secret    = env('WEBHOOK_SECRET');

    $expected = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);

    if (! hash_equals($expected, $signature)) {
        abort(401, 'Invalid signature');
    }

    $event = $request->json()->all();
    Log::info('Safravo webhook', ['event' => $event['event'], 'id' => $event['id']]);

    return response()->json(['received' => true]);
});

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "os"
)

func verifySignature(body []byte, signature, secret string) bool {
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write(body)
    expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(expected), []byte(signature))
}

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)

    sig := r.Header.Get("X-Safravo-Signature")
    if !verifySignature(body, sig, os.Getenv("WEBHOOK_SECRET")) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }

    var event map[string]interface{}
    json.Unmarshal(body, &event)
    fmt.Printf("Event: %s | ID: %s\n", event["event"], event["id"])

    w.WriteHeader(http.StatusOK)
    w.Write([]byte(`{"received":true}`))
}

func main() {
    http.HandleFunc("/webhooks/safravo", webhookHandler)
    http.ListenAndServe(":8080", nil)
}

require 'sinatra'
require 'openssl'
require 'json'

post '/webhooks/safravo' do
  raw_body  = request.body.read
  signature = request.env['HTTP_X_SAFRAVO_SIGNATURE']
  secret    = ENV['WEBHOOK_SECRET']

  expected = 'sha256=' + OpenSSL::HMAC.hexdigest('sha256', secret, raw_body)

  unless Rack::Utils.secure_compare(expected, signature)
    halt 401, 'Invalid signature'
  end

  event = JSON.parse(raw_body)
  puts "Event: #{event['event']} | ID: #{event['id']}"

  content_type :json
  { received: true }.to_json
end