Webhooks

import { createHmac, timingSafeEqual } from 'node:crypto';

// Use the raw request body exactly as received, before any JSON parsing.
export function verifySiarWebhook(rawBody, headers, secret, toleranceSeconds = 300) {
  const timestamp = headers['x-siar-timestamp'];
  const signature = headers['x-siar-signature'];
  if (!timestamp || !signature) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > toleranceSeconds) return false;
  const expected = createHmac('sha256', secret).update(`${timestamp}.${rawBody}`).digest('hex');
  const a = Buffer.from(expected, 'hex');
  const b = Buffer.from(String(signature), 'hex');
  return a.length === b.length && timingSafeEqual(a, b);
}

// Express example: keep the raw body for this route.
app.post('/webhooks/siar', express.raw({ type: 'application/json' }), (req, res) => {
  const raw = req.body.toString('utf8');
  if (!verifySiarWebhook(raw, req.headers, process.env.SIAR_WEBHOOK_SECRET)) return res.sendStatus(401);
  const event = JSON.parse(raw);
  // Deduplicate on the x-siar-delivery header or event.id, then handle event.type.
  res.sendStatus(200);
});

import hashlib, hmac, time

def verify_siar_webhook(raw_body: bytes, headers, secret: str, tolerance: int = 300) -> bool:
    timestamp = headers.get("x-siar-timestamp")
    signature = headers.get("x-siar-signature")
    if not timestamp or not signature:
        return False
    if abs(time.time() - int(timestamp)) > tolerance:
        return False
    message = timestamp.encode() + b"." + raw_body
    expected = hmac.new(secret.encode(), message, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

# Flask example
@app.post("/webhooks/siar")
def siar_webhook():
    raw = request.get_data()  # raw bytes, before JSON parsing
    if not verify_siar_webhook(raw, request.headers, os.environ["SIAR_WEBHOOK_SECRET"]):
        abort(401)
    event = request.get_json()
    return "", 200

import { Siar } from '@siar/sdk';
const siar = new Siar();

app.post('/webhooks/siar', express.raw({ type: 'application/json' }), (req, res) => {
  const event = siar.webhooks.constructEvent(req.body, req.headers, process.env.SIAR_WEBHOOK_SECRET);
  if (event.type === 'post.published') {
    // event.data holds the post; deduplicate on event.id
  }
  res.sendStatus(200);
});