Webhooks

const crypto = require('crypto');
const express = require('express');

const app = express();
const SECRET = process.env.TEAMUP_WEBHOOK_SECRET; // whsec_…

function verifySignature(rawBody, signature, secret) {
  const expected = 'sha256=' +
    crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  const a = Buffer.from(expected);
  const b = Buffer.from(signature || '');
  // timingSafeEqual throws when the lengths differ, so check that first.
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// express.raw() keeps the body as a Buffer: the exact bytes Team Up signed.
// Register this route BEFORE any app.use(express.json()), or the JSON parser
// consumes the body first.
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verifySignature(req.body, req.get('X-Signature'), SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body.toString('utf8'));
  // Process the webhook...
  res.status(200).send('OK');
});

// Any runtime with the Fetch API Request and Web Crypto. handleWebhook takes
// the signing secret (whsec_…) as an argument; wire it into yours:
//
// Cloudflare Workers:
//   export default { fetch: (req, env) => handleWebhook(req, env.TEAMUP_WEBHOOK_SECRET) };
// Next.js route handler (app/api/teamup/route.js):
//   export const POST = (req) => handleWebhook(req, process.env.TEAMUP_WEBHOOK_SECRET);
// Deno:
//   Deno.serve((req) => handleWebhook(req, Deno.env.get('TEAMUP_WEBHOOK_SECRET')));
// Bun:
//   Bun.serve({ fetch: (req) => handleWebhook(req, process.env.TEAMUP_WEBHOOK_SECRET) });

async function verifySignature(rawBody, signature, secret) {
  if (!signature || !signature.startsWith('sha256=')) return false;
  const hex = signature.slice('sha256='.length);
  if (!/^[0-9a-f]{64}$/.test(hex)) return false;
  const given = new Uint8Array(hex.match(/../g).map((h) => parseInt(h, 16)));

  const key = await crypto.subtle.importKey(
    'raw',
    new TextEncoder().encode(secret),
    { name: 'HMAC', hash: 'SHA-256' },
    false,
    ['verify']
  );
  // subtle.verify compares in constant time.
  return crypto.subtle.verify('HMAC', key, given, rawBody);
}

async function handleWebhook(request, secret) {
  // Read the bytes before parsing anything.
  const rawBody = await request.arrayBuffer();
  const ok = await verifySignature(rawBody, request.headers.get('X-Signature'), secret);
  if (!ok) return new Response('Invalid signature', { status: 401 });

  const event = JSON.parse(new TextDecoder().decode(rawBody));
  // Process the webhook...
  return new Response('OK');
}

import hashlib
import hmac
import os

from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ['TEAMUP_WEBHOOK_SECRET']  # whsec_…

def verify_signature(raw_body: bytes, signature, secret: str) -> bool:
    expected = 'sha256=' + hmac.new(
        secret.encode('utf-8'),
        raw_body,
        hashlib.sha256
    ).hexdigest()
    # Compare bytes: a missing header becomes b'' rather than an error.
    return hmac.compare_digest(expected.encode(), (signature or '').encode())

@app.route('/webhook', methods=['POST'])
def webhook():
    raw_body = request.get_data()  # the bytes as received
    if not verify_signature(raw_body, request.headers.get('X-Signature'), SECRET):
        return 'Invalid signature', 401

    event = request.get_json()
    # Process the webhook...
    return 'OK', 200