Webhooks

import express from 'express';
import { createHmac, timingSafeEqual } from 'node:crypto';

const SECRET = process.env.MEETINGKIT_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 300;

function verify(rawBody, header) {
  const timestamp = header?.match(/(?:^|,)t=(\d+)/)?.[1];
  const supplied = header?.match(/(?:^|,)v1=([0-9a-f]+)/)?.[1];
  if (!timestamp || !supplied) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > TOLERANCE_SECONDS) return false;

  const expected = createHmac('sha256', SECRET).update(`${timestamp}.`).update(rawBody).digest();
  const given = Buffer.from(supplied, 'hex');
  return given.length === expected.length && timingSafeEqual(given, expected);
}

const app = express();

app.post(
  '/webhooks/meetingkit',
  express.raw({ type: 'application/json', limit: '50mb' }),
  (req, res) => {
    if (!verify(req.body, req.get('X-HappyScribe-Signature'))) return res.sendStatus(400);

    const event = JSON.parse(req.body);
    // Store the event durably, then acknowledge. Do the slow work in a background job.
    saveEvent(event);
    res.sendStatus(204);
  },
);

import hashlib
import hmac
import json
import os
import re
import time

from flask import Flask, request

SECRET = os.environ["MEETINGKIT_WEBHOOK_SECRET"].encode()
TOLERANCE_SECONDS = 300

app = Flask(__name__)


def verify(raw_body: bytes, header: str | None) -> bool:
    timestamp = re.search(r"(?:^|,)t=(\d+)", header or "")
    supplied = re.search(r"(?:^|,)v1=([0-9a-f]+)", header or "")
    if not timestamp or not supplied:
        return False
    if abs(time.time() - int(timestamp[1])) > TOLERANCE_SECONDS:
        return False

    expected = hmac.new(SECRET, timestamp[1].encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, supplied[1])


@app.post("/webhooks/meetingkit")
def meetingkit_webhook():
    raw_body = request.get_data()
    if not verify(raw_body, request.headers.get("X-HappyScribe-Signature")):
        return "", 400

    event = json.loads(raw_body)
    # Store the event durably, then acknowledge. Do the slow work in a background job.
    save_event(event)
    return "", 204