Webhooks

curl -s $FFA/webhooks -H "Authorization: Bearer $FFA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/hooks/fax", "event_types": ["fax.delivered", "fax.failed", "fax.partially_delivered", "fax.outcome_unknown", "fax.received"]}'

import base64, hmac, hashlib, time

def verify(secret: str, headers: dict, body: bytes, tolerance_s: int = 300) -> str:
    h = {k.lower(): v for k, v in headers.items()}
    msg_id, ts, sigs = h["webhook-id"], h["webhook-timestamp"], h["webhook-signature"]
    if abs(time.time() - int(ts)) > tolerance_s:
        raise ValueError("stale")
    key = base64.b64decode(secret.removeprefix("whsec_"))
    want = hmac.new(key, f"{msg_id}.{ts}.".encode() + body, hashlib.sha256).digest()
    for sig in sigs.split():
        if sig.startswith("v1,") and hmac.compare_digest(base64.b64decode(sig[3:]), want):
            return msg_id
    raise ValueError("no signature matched")

import { createHmac, timingSafeEqual } from 'node:crypto'

export function verify(secret: string, headers: Record<string, string>, body: Buffer, toleranceS = 300): string {
  const h = Object.fromEntries(Object.entries(headers).map(([k, v]) => [k.toLowerCase(), v]))
  const id = h['webhook-id'], ts = h['webhook-timestamp'], sigs = h['webhook-signature']
  if (Math.abs(Date.now() / 1000 - Number(ts)) > toleranceS) throw new Error('stale')
  const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64')
  const want = createHmac('sha256', key).update(`${id}.${ts}.`).update(body).digest()
  for (const sig of sigs.split(' ')) {
    if (!sig.startsWith('v1,')) continue
    const got = Buffer.from(sig.slice(3), 'base64')
    if (got.length === want.length && timingSafeEqual(got, want)) return id
  }
  throw new Error('no signature matched')
}