워크스페이스 단위 웹훅

import hmac, hashlib, json, time, os
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()
WEBHOOK_KEY = os.environ["VOX_WEBHOOK_KEY"]
TOLERANCE = 5 * 60  # 5분

def verify_webhook(body: bytes, timestamp: str, signature: str, secret: str) -> bool:
    if not timestamp or not signature:
        return False

    try:
        timestamp_seconds = int(timestamp)
    except ValueError:
        return False

    if abs(time.time() - timestamp_seconds) > TOLERANCE:
        return False

    provided = signature.removeprefix("sha256=")
    expected = hmac.new(
        secret.encode("utf-8"),
        timestamp.encode("utf-8") + b"." + body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, provided)

@app.post("/webhook")
async def handle_webhook(request: Request):
    body = await request.body()
    ts = request.headers.get("X-Webhook-Timestamp", "")
    sig = request.headers.get("X-Webhook-Signature", "")

    if not verify_webhook(body, ts, sig, WEBHOOK_KEY):
        raise HTTPException(status_code=401)

    data = json.loads(body)
    # 페이로드 처리 ...

const crypto = require("crypto");
const express = require("express");

const app = express();
const WEBHOOK_KEY = process.env.VOX_WEBHOOK_KEY;
const TOLERANCE = 5 * 60; // 5분

function verifyWebhook(body, timestamp, signature, secret) {
  if (!timestamp || !signature) return false;
  if (!Buffer.isBuffer(body)) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > TOLERANCE) return false;

  const provided = signature.replace("sha256=", "");
  if (!/^[0-9a-f]{64}$/i.test(provided)) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(Buffer.concat([Buffer.from(`${timestamp}.`, "utf8"), body]))
    .digest("hex");

  return crypto.timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(provided, "hex"));
}

app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const ts = String(req.headers["x-webhook-timestamp"] || "");
  const sig = String(req.headers["x-webhook-signature"] || "");

  if (!verifyWebhook(req.body, ts, sig, WEBHOOK_KEY)) {
    return res.status(401).json({ error: "Invalid signature" });
  }

  const data = JSON.parse(req.body.toString("utf8"));
  // 페이로드 처리 ...
});