Project Completion Webhooks

Content-Type: application/json
X-InitRepo-Event: project.completed
User-Agent: InitRepo-Webhooks/1.0
X-InitRepo-Signature: sha256=abc123def456...
X-InitRepo-Timestamp: 1699123456
X-Request-ID: req_1234567890
API-Version: v1.0

import crypto from 'crypto';

function verifyWebhookSignature(payload, signature, secret) {
  // Create HMAC hash of the payload
  const hmac = crypto.createHmac('sha256', secret);
  hmac.update(payload, 'utf8');
  const expectedSignature = `sha256=${hmac.digest('hex')}`;
  
  // Use timingSafeEqual to prevent timing attacks
  const sigBuffer = Buffer.from(signature, 'utf8');
  const expectedBuffer = Buffer.from(expectedSignature, 'utf8');
  
  return sigBuffer.length === expectedBuffer.length && 
         crypto.timingSafeEqual(sigBuffer, expectedBuffer);
}

// Example webhook handler with signature verification
app.post('/webhooks/initrepo', (req, res) => {
  const signature = req.headers['x-initrepo-signature'];
  const payload = JSON.stringify(req.body);
  const secret = process.env.INITREPO_WEBHOOK_SECRET;

  // Verify signature
  if (!verifyWebhookSignature(payload, signature, secret)) {
    console.error('Invalid webhook signature');
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const { event, data } = req.body;

  // Validate event type
  if (event !== 'project.completed') {
    return res.status(400).json({ error: 'Invalid event type' });
  }

  // Process the webhook
  console.log('Project completed:', data.projectId);
  res.status(200).json({ received: true });
});

import hmac
import hashlib

def verify_webhook_signature(payload, signature, secret):
    """Verify webhook signature using HMAC-SHA256"""
    expected = hmac.new(
        secret.encode('utf-8'),
        payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
    expected_sig = f"sha256={expected}"
    
    return hmac.compare_digest(expected_sig, signature)

@app.route('/webhooks/initrepo', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-InitRepo-Signature')
    payload = request.get_data(as_text=True)
    secret = os.environ['INITREPO_WEBHOOK_SECRET']
    
    if not verify_webhook_signature(payload, signature, secret):
        return jsonify({'error': 'Invalid signature'}), 401
    
    data = request.json
    # Process webhook...
    return jsonify({'received': True}), 200

app.post('/webhooks/initrepo', (req, res) => {
  // Verify content type
  if (req.headers['content-type'] !== 'application/json') {
    return res.status(400).json({ error: 'Invalid content type' });
  }

  // Verify user agent
  const userAgent = req.headers['user-agent'];
  if (!userAgent || !userAgent.startsWith('InitRepo-Webhooks/')) {
    return res.status(400).json({ error: 'Invalid user agent' });
  }

  // Verify timestamp (prevent replay attacks)
  const timestamp = parseInt(req.headers['x-initrepo-timestamp']);
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - timestamp) > 300) { // 5 minute tolerance
    return res.status(400).json({ error: 'Request too old' });
  }

  // Continue with signature verification...
});

{
  "webhookId": "wh_1234567890",
  "url": "https://your-app.com/webhooks/initrepo",
  "attempts": [
    {
      "attemptNumber": 1,
      "timestamp": "2024-01-15T10:45:00Z",
      "status": "failed",
      "httpStatus": 500,
      "responseTime": 2.5,
      "error": "Internal Server Error"
    },
    {
      "attemptNumber": 2,
      "timestamp": "2024-01-15T10:45:01Z", 
      "status": "success",
      "httpStatus": 200,
      "responseTime": 0.8
    }
  ],
  "finalStatus": "delivered"
}

// Get webhook delivery stats for a project
const response = await fetch(`https://api.initrepo.com/v1/projects/${projectId}/webhooks`, {
  headers: {
    'Authorization': 'Bearer ir_live_your_api_key'
  }
});

const { webhookDeliveries } = await response.json();

// Implement idempotency to handle duplicate webhooks
const processedWebhooks = new Set();

app.post('/webhooks/initrepo', (req, res) => {
  const { data } = req.body;
  const projectId = data.projectId;

  if (processedWebhooks.has(projectId)) {
    return res.status(200).json({ message: 'Already processed' });
  }

  // Process webhook
  processedWebhooks.add(projectId);

  res.status(200).json({ received: true });
});

// Log all webhook attempts
app.post('/webhooks/initrepo', (req, res) => {
  const timestamp = new Date().toISOString();
  const { event, data } = req.body;

  console.log(`[${timestamp}] Webhook received: ${event} for project ${data.projectId}`);

  // Process webhook...

  res.status(200).json({ received: true });
});

# Using ngrok
ngrok http 3000
# Forwarding: https://abc123.ngrok.io -> http://localhost:3000

# Update webhook URL in request
{
  "webhookUrl": "https://abc123.ngrok.io/webhooks/initrepo"
}