Receive events with webhooks

import crypto from "node:crypto";

const SECRET = process.env.FEATUREBASE_WEBHOOK_SECRET;

// rawBody: the request body exactly as received (Buffer or string)
export function verifyFeaturebaseWebhook(rawBody, headers) {
  const signature = headers["x-webhook-signature"];
  const timestamp = headers["x-webhook-timestamp"];
  if (!signature || !timestamp) return false;

  // Reject requests older than 5 minutes
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;

  const expected = crypto
    .createHmac("sha256", SECRET)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

import hashlib
import hmac
import os
import time

SECRET = os.environ["FEATUREBASE_WEBHOOK_SECRET"]


def verify_featurebase_webhook(raw_body: bytes, headers) -> bool:
    """raw_body: the request body exactly as received."""
    signature = headers.get("X-Webhook-Signature")
    timestamp = headers.get("X-Webhook-Timestamp")
    if not signature or not timestamp or not timestamp.isdigit():
        return False

    # Reject requests older than 5 minutes
    if abs(time.time() - int(timestamp)) > 300:
        return False

    signed_payload = timestamp.encode() + b"." + raw_body
    expected = hmac.new(SECRET.encode(), signed_payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

<?php

function verifyFeaturebaseWebhook(string $rawBody, ?string $signature, ?string $timestamp): bool
{
    if (!$signature || !$timestamp || !ctype_digit($timestamp)) {
        return false;
    }

    // Reject requests older than 5 minutes
    if (abs(time() - (int) $timestamp) > 300) {
        return false;
    }

    $secret = getenv('FEATUREBASE_WEBHOOK_SECRET');
    $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    return hash_equals($expected, $signature);
}

// Usage:
// $ok = verifyFeaturebaseWebhook(
//     file_get_contents('php://input'),
//     $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? null,
//     $_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? null
// );

require "openssl"

# raw_body: the request body exactly as received (Rails: request.raw_post)
def verify_featurebase_webhook(raw_body, signature, timestamp)
  return false if signature.nil? || timestamp.nil? || timestamp !~ /\A\d+\z/

  # Reject requests older than 5 minutes
  return false if (Time.now.to_i - timestamp.to_i).abs > 300

  secret = ENV.fetch("FEATUREBASE_WEBHOOK_SECRET")
  expected = OpenSSL::HMAC.hexdigest("SHA256", secret, "#{timestamp}.#{raw_body}")
  OpenSSL.secure_compare(expected, signature) # Ruby 3.0+
end

package webhooks

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"os"
	"strconv"
	"time"
)

// rawBody: the request body exactly as received
func VerifyFeaturebaseWebhook(rawBody []byte, signature, timestamp string) bool {
	if signature == "" || timestamp == "" {
		return false
	}
	ts, err := strconv.ParseInt(timestamp, 10, 64)
	if err != nil {
		return false
	}

	// Reject requests older than 5 minutes
	if age := time.Now().Unix() - ts; age > 300 || age < -300 {
		return false
	}

	mac := hmac.New(sha256.New, []byte(os.Getenv("FEATUREBASE_WEBHOOK_SECRET")))
	mac.Write([]byte(timestamp + "."))
	mac.Write(rawBody)
	expected := hex.EncodeToString(mac.Sum(nil))
	return hmac.Equal([]byte(expected), []byte(signature))
}

import express from "express";
import { verifyFeaturebaseWebhook } from "./verify.js";

const app = express();

app.post(
  "/webhooks/featurebase",
  express.raw({ type: "application/json" }), // keep the raw body for the signature
  (req, res) => {
    if (!verifyFeaturebaseWebhook(req.body, req.headers)) {
      return res.sendStatus(401);
    }
    res.sendStatus(200); // respond first, then do the work

    const event = JSON.parse(req.body);
    handleEvent(event).catch(console.error);
  },
);

async function handleEvent(event) {
  // The same event can arrive more than once
  if (await alreadyProcessed(event.id)) return;

  switch (event.topic) {
    case "post.created":
      // event.data.item is the new post
      break;
    case "conversation.user.replied":
      // event.data.item is the new message
      break;
  }

  await markProcessed(event.id);
}

import json

from fastapi import BackgroundTasks, FastAPI, HTTPException, Request

app = FastAPI()


@app.post("/webhooks/featurebase")
async def featurebase_webhook(request: Request, background: BackgroundTasks):
    raw_body = await request.body()  # keep the raw body for the signature
    if not verify_featurebase_webhook(raw_body, request.headers):
        raise HTTPException(status_code=401)

    # The task runs after the 200 response is sent
    background.add_task(handle_event, json.loads(raw_body))
    return {"ok": True}


def handle_event(event: dict) -> None:
    # The same event can arrive more than once
    if already_processed(event["id"]):
        return

    if event["topic"] == "post.created":
        ...  # event["data"]["item"] is the new post
    elif event["topic"] == "conversation.user.replied":
        ...  # event["data"]["item"] is the new message

    mark_processed(event["id"])