Webhooks

import express from "express";
import crypto from "crypto";

const app = express();
const SECRET = process.env.ONCHAIN_WEBHOOK_SECRET; // "whsec_…"

// Capture the RAW body: signature is over the exact bytes we send.
app.post(
  "/hooks/onchainsuite",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const sig = req.get("X-OnChain-Signature") || "";
    const parts = Object.fromEntries(
      sig.split(",").map((kv) => kv.split("=").map((s) => s.trim())),
    );
    const { t, v1 } = parts;
    if (!t || !v1) return res.status(400).send("missing signature");

    const raw = req.body.toString("utf8");
    const expected = crypto
      .createHmac("sha256", SECRET)
      .update(`${t}.${raw}`)
      .digest("hex");

    const a = Buffer.from(expected);
    const b = Buffer.from(v1);
    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.status(400).send("bad signature");
    }
    // Optional replay guard: t is Unix SECONDS.
    if (Math.abs(Math.floor(Date.now() / 1000) - Number(t)) > 300) {
      return res.status(400).send("stale timestamp");
    }

    const event = JSON.parse(raw); // { id, type, createdAt, data }
    // Dedupe on event.id (== X-OnChain-Delivery) before doing work.
    console.log(event.type, event.data);

    res.status(200).send("ok"); // any 2xx/3xx = success
  },
);

app.listen(3000);

import hmac, hashlib, time, os
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["ONCHAIN_WEBHOOK_SECRET"].encode()  # b"whsec_…"

@app.post("/hooks/onchainsuite")
def hook():
    sig = request.headers.get("X-OnChain-Signature", "")
    parts = dict(kv.strip().split("=", 1) for kv in sig.split(",") if "=" in kv)
    t, v1 = parts.get("t"), parts.get("v1")
    if not t or not v1:
        abort(400)

    raw = request.get_data()  # raw bytes, exactly as delivered
    expected = hmac.new(SECRET, f"{t}.".encode() + raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, v1):
        abort(400)
    if abs(int(time.time()) - int(t)) > 300:   # t is Unix seconds
        abort(400)

    event = request.get_json()  # { id, type, createdAt, data }
    # Dedupe on event["id"] before doing work.
    return "ok", 200

// app/api/webhooks/onchain/route.ts
import { NextRequest, NextResponse } from "next/server";
import crypto from "crypto";

export const runtime = "nodejs";        // Node crypto + raw body, not the edge runtime
export const dynamic = "force-dynamic"; // never cache a webhook

const SECRET = process.env.ONCHAIN_WEBHOOK_SECRET!; // whsec_…

function verify(header: string | null, raw: string): boolean {
  if (!header) return false;
  const parts = Object.fromEntries(header.split(",").map((kv) => kv.split("=")));
  if (!parts.t || !parts.v1) return false;
  const expected = crypto.createHmac("sha256", SECRET).update(`${parts.t}.${raw}`).digest("hex");
  const a = Buffer.from(expected), b = Buffer.from(parts.v1);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

export async function POST(req: NextRequest) {
  const raw = await req.text(); // RAW body, verify against this exact string
  if (!verify(req.headers.get("x-onchain-signature"), raw))
    return new NextResponse("bad signature", { status: 401 });

  const evt = JSON.parse(raw); // { id, type, createdAt, data }
  switch (evt.type) {
    case "contact.created": /* upsert the user, start a welcome flow */ break;
    case "contact.unsubscribed": /* flip a suppression flag */ break;
    case "message.clicked": /* record analytics */ break;
    case "automation.completed": /* downstream fulfilment */ break;
    default: /* ignore unknown types; new ones can appear later */ break;
  }
  return NextResponse.json({ received: true }); // 2xx fast, slow work afterward
}