Webhooks

import hmac
import hashlib
import os
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()
SECRET = os.environ["CLEVIS_WEBHOOK_SECRET"].encode()

@app.post("/webhooks/clevis-payouts")
async def handle(request: Request):
    raw = await request.body()
    sent = request.headers.get("X-Clevis-Signature", "")
    if not sent.startswith("sha256="):
        raise HTTPException(400, "Missing or malformed signature")

    expected = "sha256=" + hmac.new(SECRET, raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sent, expected):
        raise HTTPException(401, "Bad signature")

    event = await request.json()
    payout = event["data"]
    print(
        f"{payout['id']}: {event['previous_status']} -> {payout['status']}"
    )
    return {"ok": True}

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.CLEVIS_WEBHOOK_SECRET;

// IMPORTANT: capture the raw body before JSON parsing — the signature is
// computed over the exact bytes that were sent.
app.post(
  "/webhooks/clevis-payouts",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const sent = req.header("X-Clevis-Signature") || "";
    if (!sent.startsWith("sha256=")) {
      return res.status(400).send("Missing or malformed signature");
    }

    const expected =
      "sha256=" +
      crypto.createHmac("sha256", SECRET).update(req.body).digest("hex");

    if (
      sent.length !== expected.length ||
      !crypto.timingSafeEqual(Buffer.from(sent), Buffer.from(expected))
    ) {
      return res.status(401).send("Bad signature");
    }

    const event = JSON.parse(req.body.toString("utf8"));
    const payout = event.data;
    console.log(
      `${payout.id}: ${event.previous_status} -> ${payout.status}`
    );
    res.json({ ok: true });
  }
);