Webhooks de saída

import express from "express";
import { Webhook } from "standardwebhooks";

const wh = new Webhook(process.env.WEVE_WEBHOOK_SECRET!); // "whsec_…"
const app = express();

// express.raw: o corpo chega como Buffer, sem parse.
app.post("/weve/webhooks", express.raw({ type: "application/json" }), (req, res) => {
  let event;
  try {
    // Confere assinatura e timestamp (tolerância de 5 minutos) e devolve o JSON.
    event = wh.verify(req.body, {
      "webhook-id": req.header("webhook-id")!,
      "webhook-timestamp": req.header("webhook-timestamp")!,
      "webhook-signature": req.header("webhook-signature")!,
    });
  } catch {
    return res.status(401).end();
  }

  enqueue(event); // processe depois
  res.status(204).end();
});

import os

from flask import Flask, request
from standardwebhooks.webhooks import Webhook, WebhookVerificationError

wh = Webhook(os.environ["WEVE_WEBHOOK_SECRET"])  # "whsec_…"
app = Flask(__name__)

@app.post("/weve/webhooks")
def weve_webhooks():
    try:
        # request.get_data(): o corpo cru, em bytes.
        event = wh.verify(request.get_data(), request.headers)
    except WebhookVerificationError:
        return "", 401

    enqueue(event)  # processe depois
    return "", 204

<?php
$secret = getenv('WEVE_WEBHOOK_SECRET'); // "whsec_…"
$body = file_get_contents('php://input'); // o corpo cru

$id = $_SERVER['HTTP_WEBHOOK_ID'] ?? '';
$timestamp = $_SERVER['HTTP_WEBHOOK_TIMESTAMP'] ?? '';
$signatures = $_SERVER['HTTP_WEBHOOK_SIGNATURE'] ?? '';

if ($id === '' || !ctype_digit($timestamp) || abs(time() - (int) $timestamp) > 300) {
    http_response_code(401);
    exit;
}

$key = base64_decode(substr($secret, strlen('whsec_')));
$expected = base64_encode(hash_hmac('sha256', "$id.$timestamp.$body", $key, true));

$valid = false;
foreach (preg_split('/\s+/', trim($signatures)) as $candidate) {
    [$version, $signature] = array_pad(explode(',', $candidate, 2), 2, '');
    if ($version === 'v1' && hash_equals($expected, $signature)) {
        $valid = true;
        break;
    }
}

if (!$valid) {
    http_response_code(401);
    exit;
}

$event = json_decode($body, true);
enqueue($event); // processe depois
http_response_code(204);

package weve

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
	"io"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)

func WebhookHandler(w http.ResponseWriter, r *http.Request) {
	body, err := io.ReadAll(r.Body) // o corpo cru
	if err != nil {
		http.Error(w, "", http.StatusBadRequest)
		return
	}

	id := r.Header.Get("webhook-id")
	timestamp := r.Header.Get("webhook-timestamp")

	unix, err := strconv.ParseInt(timestamp, 10, 64)
	if err != nil || id == "" || time.Since(time.Unix(unix, 0)).Abs() > 5*time.Minute {
		http.Error(w, "", http.StatusUnauthorized)
		return
	}

	secret := strings.TrimPrefix(os.Getenv("WEVE_WEBHOOK_SECRET"), "whsec_")
	key, err := base64.StdEncoding.DecodeString(secret)
	if err != nil {
		http.Error(w, "", http.StatusInternalServerError)
		return
	}

	mac := hmac.New(sha256.New, key)
	mac.Write([]byte(id + "." + timestamp + "."))
	mac.Write(body)
	expected := mac.Sum(nil)

	valid := false
	for _, candidate := range strings.Fields(r.Header.Get("webhook-signature")) {
		version, value, ok := strings.Cut(candidate, ",")
		if !ok || version != "v1" {
			continue
		}
		got, err := base64.StdEncoding.DecodeString(value)
		// hmac.Equal compara em tempo constante.
		if err == nil && hmac.Equal(got, expected) {
			valid = true
			break
		}
	}

	if !valid {
		http.Error(w, "", http.StatusUnauthorized)
		return
	}

	enqueue(body) // processe depois
	w.WriteHeader(http.StatusNoContent)
}