Webhooks and telemetry export

import base64, hashlib, hmac, json, os, time
from flask import Flask, request, abort

SECRET = os.environ["ANONA_WEBHOOK_SECRET"]  # whsec_...
KEY = base64.b64decode(SECRET.removeprefix("whsec_"))
app = Flask(__name__)

@app.post("/anona/webhooks")
def hook():
    msg_id = request.headers.get("webhook-id", "")
    ts = request.headers.get("webhook-timestamp", "0")
    body = request.get_data()  # raw bytes
    if not msg_id or abs(time.time() - int(ts)) > 300:
        abort(400)
    mac = hmac.new(KEY, f"{msg_id}.{ts}.".encode() + body, hashlib.sha256).digest()
    want = "v1," + base64.b64encode(mac).decode()
    if not any(hmac.compare_digest(s, want) for s in request.headers.get("webhook-signature", "").split(" ")):
        abort(401)
    event = json.loads(body)  # deduplicate on event["id"]
    print(event["type"], event["sandboxId"])
    return "", 200

import { createHmac, timingSafeEqual } from "node:crypto";
import express from "express";

const secret = process.env.ANONA_WEBHOOK_SECRET; // whsec_...
const app = express();
app.post("/anona/webhooks", express.raw({ type: "application/json" }), (req, res) => {
  const id = req.header("webhook-id");
  const ts = req.header("webhook-timestamp");
  const sigs = (req.header("webhook-signature") ?? "").split(" ");
  if (!id || !ts || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return res.sendStatus(400);
  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const want = "v1," + createHmac("sha256", key).update(`${id}.${ts}.`).update(req.body).digest("base64");
  const ok = sigs.some((s) => s.length === want.length && timingSafeEqual(Buffer.from(s), Buffer.from(want)));
  if (!ok) return res.sendStatus(401);
  const event = JSON.parse(req.body); // deduplicate on event.id
  console.log(event.type, event.sandboxId);
  res.sendStatus(200);
});
app.listen(8080);