Webhooks

import hashlib
import hmac
import json
import os

from fastapi import FastAPI, Header, Request, Response

app = FastAPI()
SIGNING_SECRET = os.getenv("HYDRADB_WEBHOOK_SECRET")


@app.post("/webhooks/hydradb")
async def hydradb_webhook(
    request: Request,
    delivery_id: str | None = Header(default=None, alias="X-HydraDB-Delivery-ID"),
    signature: str | None = Header(default=None, alias="X-HydraDB-Signature"),
):
    raw_body = await request.body()

    if SIGNING_SECRET:
        digest = hmac.new(
            SIGNING_SECRET.encode(),
            raw_body,
            hashlib.sha256,
        ).hexdigest()
        expected = f"sha256={digest}"

        if not signature or not hmac.compare_digest(signature, expected):
            return Response(status_code=401)

    event = json.loads(raw_body)

    # Store delivery_id and skip it if you have already processed it.
    print("HydraDB webhook", delivery_id, event["id"], event["status"])

    return Response(status_code=204)

import crypto from "node:crypto";
import express from "express";

const app = express();
const signingSecret = process.env.HYDRADB_WEBHOOK_SECRET;

app.post(
  "/webhooks/hydradb",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const deliveryId = req.header("X-HydraDB-Delivery-ID");
    const signature = req.header("X-HydraDB-Signature");
    const rawBody = req.body as Buffer;

    if (signingSecret) {
      const expected =
        "sha256=" +
        crypto.createHmac("sha256", signingSecret).update(rawBody).digest("hex");
      const expectedBuffer = Buffer.from(expected);
      const signatureBuffer = Buffer.from(signature || "");

      if (
        signatureBuffer.length !== expectedBuffer.length ||
        !crypto.timingSafeEqual(signatureBuffer, expectedBuffer)
      ) {
        return res.status(401).send("Invalid signature");
      }
    }

    const event = JSON.parse(rawBody.toString("utf8"));

    // Store deliveryId and skip it if you have already processed it.
    console.log("HydraDB webhook", deliveryId, event.id, event.status);

    return res.status(204).send();
  }
);

app.listen(3000);