Como configurar webhooks

import crypto from "node:crypto";

const TOLERANCE_SECONDS = 300;

/**
 * @param rawBody Buffer ou string com os bytes ORIGINAIS da requisição.
 * @param signatureHeader valor de `x-tryno-signature`.
 * @param secret o `whsec_…` do endpoint.
 */
export function verifyTrynoWebhook(rawBody, signatureHeader, secret) {
  if (!signatureHeader) return false;

  // "t=1786029659,v1=9f2c…"
  const parts = {};
  for (const kv of signatureHeader.split(",")) {
    const i = kv.indexOf("=");
    if (i > 0) parts[kv.slice(0, i).trim()] = kv.slice(i + 1).trim();
  }
  const t = Number(parts.t);
  const received = parts.v1;
  if (!Number.isFinite(t) || !received) return false;

  // Janela de repetição sobre o t da ASSINATURA (não sobre `created`).
  if (Math.abs(Date.now() / 1000 - t) > TOLERANCE_SECONDS) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.`)
    .update(rawBody) // Buffer ou string — os bytes originais
    .digest("hex");

  const a = Buffer.from(expected, "utf8");
  const b = Buffer.from(received, "utf8");
  // timingSafeEqual lança se os tamanhos diferem — cheque antes.
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// --- Express ---------------------------------------------------------------
import express from "express";
const app = express();

app.post(
  "/hooks/tryno",
  express.raw({ type: "application/json" }), // NÃO use express.json() aqui
  (req, res) => {
    const ok = verifyTrynoWebhook(
      req.body, // Buffer com os bytes originais
      req.get("x-tryno-signature"),
      process.env.TRYNO_WEBHOOK_SECRET,
    );
    if (!ok) return res.status(401).send("invalid signature");

    const deliveryId = req.get("x-tryno-delivery");
    const evt = JSON.parse(req.body.toString("utf8"));

    // Responda AGORA; processe fora do caminho da resposta.
    res.status(204).end();
    void handle(deliveryId, evt).catch(console.error);
  },
);

import hashlib
import hmac
import time

TOLERANCE_SECONDS = 300


def verify_tryno_webhook(raw_body: bytes, signature_header: str, secret: str) -> bool:
    """raw_body precisa ser os BYTES originais da requisição."""
    if not signature_header:
        return False

    parts = {}
    for kv in signature_header.split(","):
        if "=" in kv:
            k, v = kv.split("=", 1)
            parts[k.strip()] = v.strip()

    t, received = parts.get("t"), parts.get("v1")
    if not t or not received:
        return False
    try:
        ts = int(t)
    except ValueError:
        return False

    # Janela de repetição sobre o t da assinatura.
    if abs(time.time() - ts) > TOLERANCE_SECONDS:
        return False

    expected = hmac.new(
        secret.encode("utf-8"),
        f"{t}.".encode("utf-8") + raw_body,
        hashlib.sha256,
    ).hexdigest()

    return hmac.compare_digest(expected, received)  # tempo constante


# --- Flask -----------------------------------------------------------------
import json
import os

from flask import Flask, request

app = Flask(__name__)


@app.post("/hooks/tryno")
def tryno_hook():
    raw = request.get_data()  # bytes originais, antes de qualquer parse
    if not verify_tryno_webhook(
        raw,
        request.headers.get("X-Tryno-Signature", ""),
        os.environ["TRYNO_WEBHOOK_SECRET"],
    ):
        return "invalid signature", 401

    delivery_id = request.headers.get("X-Tryno-Delivery", "")
    event = json.loads(raw)
    enqueue(delivery_id, event)  # trabalho pesado fora do handler
    return "", 204

package tryno

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"math"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)

const toleranceSeconds = 300

// VerifyTrynoWebhook confere x-tryno-signature sobre os bytes originais.
func VerifyTrynoWebhook(rawBody []byte, signatureHeader, secret string) bool {
	if signatureHeader == "" {
		return false
	}

	var tStr, received string
	for _, kv := range strings.Split(signatureHeader, ",") {
		k, v, found := strings.Cut(strings.TrimSpace(kv), "=")
		if !found {
			continue
		}
		switch k {
		case "t":
			tStr = v
		case "v1":
			received = v
		}
	}
	if tStr == "" || received == "" {
		return false
	}

	ts, err := strconv.ParseInt(tStr, 10, 64)
	if err != nil {
		return false
	}
	if math.Abs(float64(time.Now().Unix()-ts)) > toleranceSeconds {
		return false // fora da janela de repetição
	}

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(tStr + "."))
	mac.Write(rawBody)
	expected := hex.EncodeToString(mac.Sum(nil))

	// hmac.Equal é comparação em tempo constante.
	return hmac.Equal([]byte(expected), []byte(received))
}

func Handler(w http.ResponseWriter, r *http.Request) {
	raw, err := io.ReadAll(io.LimitReader(r.Body, 1<<20))
	if err != nil {
		http.Error(w, "bad request", http.StatusBadRequest)
		return
	}
	if !VerifyTrynoWebhook(raw, r.Header.Get("X-Tryno-Signature"), os.Getenv("TRYNO_WEBHOOK_SECRET")) {
		http.Error(w, "invalid signature", http.StatusUnauthorized)
		return
	}

	deliveryID := r.Header.Get("X-Tryno-Delivery")
	go process(deliveryID, raw) // responda rápido, processe depois
	w.WriteHeader(http.StatusNoContent)
}