Webhooks

import hashlib
import hmac
import json
import os
import time

from flask import Flask, abort, request

app = Flask(__name__)
SIGNING_SECRET = os.environ["FILEAI_WEBHOOK_SECRET"].encode()
TOLERANCE_SECONDS = 300


def is_valid_signature(timestamp: str, signature: str, raw_body: bytes) -> bool:
    if not timestamp.isdigit() or abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        return False
    signed_payload = timestamp.encode() + b"." + raw_body
    expected = hmac.new(SIGNING_SECRET, signed_payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)


@app.post("/fileai/webhooks")
def fileai_webhook():
    raw_body = request.get_data()
    if not is_valid_signature(
        request.headers.get("X-FileAI-Timestamp", ""),
        request.headers.get("X-FileAI-Signature", ""),
        raw_body,
    ):
        abort(401)

    event = json.loads(raw_body)
    if not already_handled(event["eventId"]):
        enqueue(event)
    return "", 200

import crypto from "node:crypto";
import express from "express";

const app = express();
const signingSecret = process.env.FILEAI_WEBHOOK_SECRET;
const toleranceSeconds = 300;

function isValidSignature(timestamp, signature, rawBody) {
  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!/^\d+$/.test(timestamp) || age > toleranceSeconds) {
    return false;
  }
  const expected = crypto
    .createHmac("sha256", signingSecret)
    .update(`${timestamp}.`)
    .update(rawBody)
    .digest();
  const received = Buffer.from(signature, "hex");
  return received.length === expected.length && crypto.timingSafeEqual(received, expected);
}

app.post("/fileai/webhooks", express.raw({ type: "application/json" }), (req, res) => {
  const valid = isValidSignature(
    req.get("X-FileAI-Timestamp") ?? "",
    req.get("X-FileAI-Signature") ?? "",
    req.body,
  );
  if (!valid) {
    return res.sendStatus(401);
  }

  const event = JSON.parse(req.body.toString("utf8"));
  if (!alreadyHandled(event.eventId)) {
    enqueue(event);
  }
  res.sendStatus(200);
});