Receive webhooks

const crypto = require('node:crypto');
const express = require('express');

const SIGNING_SECRET = process.env.MASTERID_WEBHOOK_SECRET;
if (!SIGNING_SECRET) throw new Error('MASTERID_WEBHOOK_SECRET is required');

const app = express();
// Use raw body parser so the signature matches the exact bytes MasterID sent
app.use('/webhooks/masterid', express.raw({ type: 'application/json' }));

const processedEventIds = new Set(); // Use Redis in production

function constantTimeCompare(a, b) {
  if (a.length !== b.length) return false;
  let result = 0;
  for (let i = 0; i < a.length; i++) {
    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
  }
  return result === 0;
}

app.post('/webhooks/masterid', (req, res) => {
  const rawBody = req.body.toString('utf8');
  const eventId = req.headers['x-masterid-event-id'];
  const timestamp = req.headers['x-masterid-timestamp'];
  const signature = req.headers['x-masterid-signature'];

  if (!eventId || !timestamp || !signature) {
    return res.status(400).send('Missing webhook headers');
  }

  const now = Math.floor(Date.now() / 1000);
  const ts = parseInt(timestamp, 10);
  if (Number.isNaN(ts) || now - ts > 300) {
    return res.status(400).send('Stale timestamp');
  }

  const expected = crypto
    .createHmac('sha256', SIGNING_SECRET)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  if (!constantTimeCompare(expected, signature)) {
    return res.status(401).send('Invalid signature');
  }

  if (processedEventIds.has(eventId)) {
    return res.status(200).send('Already processed');
  }

  let payload;
  try {
    payload = JSON.parse(rawBody);
  } catch {
    return res.status(400).send('Invalid JSON');
  }

  // Persist or enqueue the event before acknowledging
  console.log('Event accepted:', payload.event, eventId);
  processedEventIds.add(eventId);

  return res.status(200).send('Accepted');
});

app.listen(3000, () => console.log('Webhook receiver on :3000'));

import os, time, hmac, hashlib
from flask import Flask, request, jsonify

SIGNING_SECRET = os.environ.get("MASTERID_WEBHOOK_SECRET")
if not SIGNING_SECRET:
    raise RuntimeError("MASTERID_WEBHOOK_SECRET is required")

app = Flask(__name__)
processed_event_ids = set()  # Use Redis in production

def constant_time_compare(a: str, b: str) -> bool:
    return hmac.compare_digest(a, b)

@app.route("/webhooks/masterid", methods=["POST"])
def masterid_webhook():
    raw_body = request.get_data(as_text=True)
    event_id = request.headers.get("X-MasterID-Event-ID")
    timestamp = request.headers.get("X-MasterID-Timestamp")
    signature = request.headers.get("X-MasterID-Signature")

    if not event_id or not timestamp or not signature:
        return "Missing webhook headers", 400

    now = int(time.time())
    try:
        ts = int(timestamp)
    except ValueError:
        return "Invalid timestamp", 400
    if now - ts > 300:
        return "Stale timestamp", 400

    expected = hmac.new(
        SIGNING_SECRET.encode("utf-8"),
        f"{timestamp}.{raw_body}".encode("utf-8"),
        hashlib.sha256,
    ).hexdigest()

    if not constant_time_compare(expected, signature):
        return "Invalid signature", 401

    if event_id in processed_event_ids:
        return "Already processed", 200

    try:
        payload = request.get_json(force=True)
    except Exception:
        return "Invalid JSON", 400

    # Persist or enqueue the event before acknowledging
    print("Event accepted:", payload.get("event"), event_id)
    processed_event_ids.add(event_id)

    return "Accepted", 200

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=3000)