Webhooks

from hydra_db.helpers import verify_webhook_signature

if not verify_webhook_signature(secret, raw_body, signature):
    ...  # reject

import { verifyWebhookSignature } from "@hydradb/sdk/helpers";

if (!verifyWebhookSignature(secret, rawBody, signature)) {
  // reject
}

import hashlib
import hmac


def verify_webhook_signature(secret: str, raw_body: bytes, signature: str) -> bool:
    """Return True when signature is valid for raw_body."""
    if not secret or not signature:
        return False
    digest = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(signature, f"sha256={digest}")

import crypto from "node:crypto";

export function verifyWebhookSignature(
  secret: string,
  rawBody: Buffer,
  signature: string | undefined,
): boolean {
  if (!secret || !signature) {
    return false;
  }
  const expected =
    "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");

  const expectedBuffer = Buffer.from(expected);
  const signatureBuffer = Buffer.from(signature);

  // timingSafeEqual throws on a length mismatch, so guard before comparing.
  if (signatureBuffer.length !== expectedBuffer.length) {
    return false;
  }
  return crypto.timingSafeEqual(signatureBuffer, expectedBuffer);
}

import hashlib
import hmac
import json
import os

from fastapi import FastAPI, Header, Request, Response

app = FastAPI()

# Fail fast at startup when the secret is missing, rather than accepting
# unverified deliveries at request time.
SIGNING_SECRET = os.environ["HYDRADB_WEBHOOK_SECRET"]


def verify_webhook_signature(secret: str, raw_body: bytes, signature: str | None) -> bool:
    if not secret or not signature:
        return False
    digest = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(signature, f"sha256={digest}")


@app.post("/webhooks/hydradb")
async def hydradb_webhook(
    request: Request,
    delivery_id: str | None = Header(default=None, alias="X-HydraDB-Delivery-ID"),
    signature: str | None = Header(default=None, alias="X-HydraDB-Signature"),
):
    raw_body = await request.body()

    if not verify_webhook_signature(SIGNING_SECRET, raw_body, signature):
        return Response(status_code=401)

    event = json.loads(raw_body)

    # Store delivery_id and skip it if you have already processed it.
    print("HydraDB webhook", delivery_id, event["id"], event["status"])

    return Response(status_code=204)

import crypto from "node:crypto";
import express from "express";

const app = express();

// Fail fast at startup when the secret is missing, rather than accepting
// unverified deliveries at request time.
const signingSecret = process.env.HYDRADB_WEBHOOK_SECRET;
if (!signingSecret) {
  throw new Error("HYDRADB_WEBHOOK_SECRET is required");
}

function verifyWebhookSignature(
  secret: string,
  rawBody: Buffer,
  signature: string | undefined,
): boolean {
  if (!secret || !signature) {
    return false;
  }
  const expected =
    "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");

  const expectedBuffer = Buffer.from(expected);
  const signatureBuffer = Buffer.from(signature);

  if (signatureBuffer.length !== expectedBuffer.length) {
    return false;
  }
  return crypto.timingSafeEqual(signatureBuffer, expectedBuffer);
}

app.post(
  "/webhooks/hydradb",
  // express.raw is essential: the signature covers the raw bytes, so the body
  // must not be parsed before verification.
  express.raw({ type: "application/json" }),
  (req, res) => {
    const deliveryId = req.header("X-HydraDB-Delivery-ID");
    const signature = req.header("X-HydraDB-Signature");
    const rawBody = req.body as Buffer;

    if (!verifyWebhookSignature(signingSecret, rawBody, signature)) {
      return res.status(401).send("Invalid signature");
    }

    const event = JSON.parse(rawBody.toString("utf8"));

    // Store deliveryId and skip it if you have already processed it.
    console.log("HydraDB webhook", deliveryId, event.id, event.status);

    return res.status(204).send();
  }
);

app.listen(3000);

import hashlib
import hmac
import os

# During a rotation both are set. Afterwards, drop HYDRADB_WEBHOOK_SECRET_OLD.
SECRETS = [
    s for s in (
        os.environ["HYDRADB_WEBHOOK_SECRET"],
        os.environ.get("HYDRADB_WEBHOOK_SECRET_OLD"),
    ) if s
]


def verify_webhook_signature(raw_body: bytes, signature: str) -> bool:
    if not signature:
        return False
    for secret in SECRETS:
        digest = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
        if hmac.compare_digest(signature, f"sha256={digest}"):
            return True
    return False

import crypto from "node:crypto";

// During a rotation both are set. Afterwards, drop HYDRADB_WEBHOOK_SECRET_OLD.
const secrets = [
  process.env.HYDRADB_WEBHOOK_SECRET,
  process.env.HYDRADB_WEBHOOK_SECRET_OLD,
].filter((s): s is string => Boolean(s));

export function verifyWebhookSignature(rawBody: Buffer, signature: string | undefined): boolean {
  if (!signature) {
    return false;
  }
  return secrets.some((secret) => {
    const expected =
      "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
    const expectedBuffer = Buffer.from(expected);
    const signatureBuffer = Buffer.from(signature);
    if (signatureBuffer.length !== expectedBuffer.length) {
      return false;
    }
    return crypto.timingSafeEqual(signatureBuffer, expectedBuffer);
  });
}