Webhooks API

const crypto = require('crypto');

function verify(body, signature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

app.post('/webhook/docwatch', express.text({ type: '*/*' }), (req, res) => {
  const sig = req.headers['x-docwatch-signature'];
  if (!verify(req.body, sig, process.env.DOCWATCH_SECRET)) {
    return res.status(401).send('Invalid signature');
  }
  const event = JSON.parse(req.body);
  console.log('Viewed:', event.data.documentName);
  console.log('By:', event.data.viewerEmail);
  res.sendStatus(200);
});

import hmac, hashlib

def verify(body: bytes, signature: str, secret: str) -> bool:
    expected = 'sha256=' + hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

@app.route('/webhook/docwatch', methods=['POST'])
def webhook():
    sig = request.headers.get('X-DocWatch-Signature', '')
    if not verify(request.data, sig, DOCWATCH_SECRET):
        return 'Invalid signature', 401

    event = request.json
    print(f"Viewed: {event['data']['documentName']}")
    print(f"By: {event['data']['viewerEmail']}")
    return '', 200

<?php
$body = file_get_contents('php://input');
$sig = $_SERVER['HTTP_X_DOCWATCH_SIGNATURE'] ?? '';
$secret = getenv('DOCWATCH_SECRET');

$expected = 'sha256=' . hash_hmac('sha256', $body, $secret);
if (!hash_equals($expected, $sig)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($body, true);
error_log("Viewed: " . $event['data']['documentName']);
error_log("By: " . $event['data']['viewerEmail']);
http_response_code(200);