Webhooks

import crypto from 'crypto'
import express from 'express'

const app = express()

app.post('/webhooks/nawa', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-nawa-signature'] as string
  const timestamp = req.headers['x-nawa-timestamp'] as string
  const body = req.body

  // Verify timestamp is within 5 minutes
  const now = Math.floor(Date.now() / 1000)
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    return res.status(400).send('Timestamp too old')
  }

  // Compute expected signature
  const payload = `${timestamp}.${body}`
  const expected = crypto
    .createHmac('sha256', process.env.NAWA_WEBHOOK_SECRET!)
    .update(payload)
    .digest('hex')

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(400).send('Invalid signature')
  }

  const event = JSON.parse(body)
  console.log('Received event:', event.type)

  // Handle the event
  switch (event.type) {
    case 'classification.completed':
      // Process classification result
      break
    case 'credits.low':
      // Alert team about low balance
      break
  }

  res.status(200).send('OK')
})

import hmac
import hashlib
import time
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()

WEBHOOK_SECRET = "nawa_wh_your_secret"

@app.post("/webhooks/nawa")
async def handle_webhook(request: Request):
    body = await request.body()
    signature = request.headers.get("x-nawa-signature")
    timestamp = request.headers.get("x-nawa-timestamp")

    # Verify timestamp is within 5 minutes
    if abs(time.time() - int(timestamp)) > 300:
        raise HTTPException(status_code=400, detail="Timestamp too old")

    # Compute expected signature
    payload = f"{timestamp}.{body.decode()}"
    expected = hmac.new(
        WEBHOOK_SECRET.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        raise HTTPException(status_code=400, detail="Invalid signature")

    event = await request.json()
    print(f"Received event: {event['type']}")

    return {"status": "ok"}