Webhooks

const crypto = require('crypto');

function verifyWebhook(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// Express middleware example
app.post('/webhooks/nearnode', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-nearnode-signature'];
  const secret = process.env.NEARNODE_WEBHOOK_SECRET;

  if (!verifyWebhook(req.body, signature, secret)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body);
  console.log(`Received ${event.event} for ${event.data.node_slug}`);

  res.status(200).send('OK');
});

import hmac
import hashlib
from flask import Flask, request, abort

app = Flask(__name__)

def verify_webhook(payload, signature, secret):
    expected = hmac.new(
        secret.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

@app.route('/webhooks/nearnode', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-NearNode-Signature')
    secret = os.environ['NEARNODE_WEBHOOK_SECRET']

    if not verify_webhook(request.data, signature, secret):
        abort(401)

    event = request.get_json()
    print(f"Received {event['event']} for {event['data']['node_slug']}")

    return 'OK', 200

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "io"
    "net/http"
    "os"
)

func verifyWebhook(body []byte, signature, secret string) bool {
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write(body)
    expected := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(signature), []byte(expected))
}

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)
    signature := r.Header.Get("X-NearNode-Signature")
    secret := os.Getenv("NEARNODE_WEBHOOK_SECRET")

    if !verifyWebhook(body, signature, secret) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }

    w.WriteHeader(http.StatusOK)
}