API Webhook

{
  "ok": true,
  "data": {
    "data": [
      {
        "id": "whk_abc123",
        "name": "Gestore Eventi Produzione",
        "url": "https://api.tuaapp.it/webhooks/auris",
        "events": ["user.created", "user.updated", "login.success", "login.failed"],
        "isActive": true,
        "lastDeliveryAt": "2025-02-18T09:45:00Z",
        "failureCount": 0,
        "createdAt": "2025-01-15T10:00:00Z"
      }
    ],
    "pagination": { "page": 1, "limit": 20, "total": 3, "totalPages": 1 }
  }
}

{
  "name": "Gestore Eventi Produzione",
  "url": "https://api.tuaapp.it/webhooks/auris",
  "events": ["user.created", "user.updated", "user.deleted", "login.success"]
}

{
  "ok": true,
  "data": {
    "id": "whk_def456",
    "name": "Gestore Eventi Produzione",
    "url": "https://api.tuaapp.it/webhooks/auris",
    "events": ["user.created", "user.updated", "user.deleted", "login.success"],
    "secret": "whsec_7f3a8b2c4d5e6f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f",
    "isActive": true,
    "createdAt": "2025-02-18T10:00:00Z"
  }
}

{
  "name": "Gestore Eventi Produzione v2",
  "events": ["user.created", "user.updated", "user.deleted", "login.success", "login.failed", "role.assigned"],
  "isActive": true
}

{
  "ok": true,
  "data": { "deleted": true }
}

{
  "ok": true,
  "data": {
    "secret": "whsec_9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a"
  }
}

{
  "event": "webhook.test",
  "timestamp": "2025-02-18T10:30:00Z",
  "tenant": "acme-corp",
  "data": {
    "message": "Questa è una consegna di test da Auris.",
    "webhookId": "whk_abc123"
  }
}

{
  "ok": true,
  "data": {
    "data": [
      {
        "id": "del_abc123",
        "event": "user.created",
        "statusCode": 200,
        "success": true,
        "responseTime": 89,
        "attempts": 1,
        "payload": {
          "event": "user.created",
          "timestamp": "2025-02-18T09:45:00Z",
          "tenant": "acme-corp",
          "data": {
            "userId": "usr_abc123",
            "email": "[email protected]"
          }
        },
        "createdAt": "2025-02-18T09:45:00Z",
        "completedAt": "2025-02-18T09:45:01Z"
      }
    ],
    "pagination": { "page": 1, "limit": 20, "total": 156, "totalPages": 8 }
  }
}

{
  "event": "user.created",
  "timestamp": "2025-02-18T10:00:00Z",
  "tenant": "acme-corp",
  "data": {
    "userId": "usr_abc123",
    "email": "[email protected]",
    "firstName": "Alice",
    "lastName": "Rossi"
  }
}

import crypto from 'crypto';
 
function verifyWebhookSignature(rawBody, signature, timestamp, secret) {
  // 1. Controlla la freschezza del timestamp (opzionale ma consigliato)
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - parseInt(timestamp)) > 300) {
    throw new Error('Il timestamp del webhook è troppo vecchio');
  }
 
  // 2. Calcola la firma attesa
  const signedPayload = `${timestamp}.${rawBody}`;
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');
 
  // 3. Confronto timing-safe
  const expected = Buffer.from(expectedSignature, 'hex');
  const received = Buffer.from(signature, 'hex');
 
  if (expected.length !== received.length) {
    return false;
  }
 
  return crypto.timingSafeEqual(expected, received);
}
 
// Gestore Express.js
app.post('/webhooks/auris', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const timestamp = req.headers['x-webhook-timestamp'];
  const rawBody = req.body.toString('utf-8');
 
  if (!verifyWebhookSignature(rawBody, signature, timestamp, process.env.AURIS_WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Firma non valida' });
  }
 
  const event = JSON.parse(rawBody);
  console.log(`Ricevuto ${event.event}:`, event.data);
 
  // Elabora l'evento...
 
  res.status(200).json({ received: true });
});

import hmac
import hashlib
import time
 
def verify_webhook_signature(raw_body: bytes, signature: str, timestamp: str, secret: str) -> bool:
    # Controlla la freschezza del timestamp
    current_time = int(time.time())
    if abs(current_time - int(timestamp)) > 300:
        return False
 
    # Calcola la firma attesa
    signed_payload = f"{timestamp}.{raw_body.decode('utf-8')}"
    expected = hmac.new(
        secret.encode('utf-8'),
        signed_payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
 
    # Confronto timing-safe
    return hmac.compare_digest(expected, signature)