Webhook

import { type WebhookPayload } from 'babysea';
import { verifyWebhook } from 'babysea/webhooks';

async function handleWebhook(req: Request) {
  const rawBody = await req.text();
  const signature = req.headers.get('x-babysea-signature') ?? '';

  const payload = await verifyWebhook(
    rawBody,
    signature,
    process.env.BABYSEA_WEBHOOK_SECRET!,
  );

  switch (payload.webhook_event) {
    case 'generation.completed':
      for (const url of payload.webhook_data.generation_output_file ?? []) {
        await saveOutput(payload.webhook_data.generation_id, url);
      }
      break;
    case 'generation.failed':
      await logFailure(
        payload.webhook_data.generation_id,
        payload.webhook_data.generation_error,
        payload.webhook_data.generation_error_code,
      );
      break;
    case 'generation.started':
      await updateStatus(payload.webhook_data.generation_id, 'processing');
      break;
    case 'generation.canceled':
      await updateStatus(payload.webhook_data.generation_id, 'canceled');
      if (payload.webhook_data.credits_refunded) {
        await notifyRefund(payload.webhook_data.generation_id);
      }
      break;
    case 'credits.low_balance':
      await notifyFinanceTeam(
        payload.webhook_data.account_id,
        payload.webhook_data.current_balance,
        payload.webhook_data.thresholds_crossed,
      );
      break;
    case 'webhook.test':
      break;
  }

  return new Response('OK', { status: 200 });
}

import { verifyWebhook } from 'babysea/webhooks';

export async function POST(req: Request) {
  const rawBody = await req.text();
  const signature = req.headers.get('x-babysea-signature') ?? '';

  try {
    const payload = await verifyWebhook(
      rawBody,
      signature,
      process.env.BABYSEA_WEBHOOK_SECRET!,
    );

    // Acknowledge immediately, process async
    await queue.push(payload);
    return new Response('OK', { status: 200 });
  } catch {
    return new Response('Invalid signature', { status: 400 });
  }
}

import { createHmac, timingSafeEqual } from 'crypto';

function verifyWebhookSignature(
  rawBody: string,
  signatureHeader: string,
  secret: string,
  toleranceSeconds = 300,
): object {
  const parts = Object.fromEntries(
    signatureHeader.split(',').map((p) => p.split('=', 2)),
  );
  const timestamp = parts['t'];
  const signature = parts['v1'];

  if (!timestamp || !signature) throw new Error('Missing signature components');

  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - Number(timestamp)) > toleranceSeconds) {
    throw new Error('Timestamp outside tolerance');
  }

  const expected = createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  const valid = timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(signature, 'hex'),
  );

  if (!valid) throw new Error('Invalid signature');

  return JSON.parse(rawBody);
}

import hmac, hashlib, time, json

def verify_babysea_webhook(raw_body: str, signature_header: str, secret: str, tolerance: int = 300) -> dict:
    parts = dict(p.split("=", 1) for p in signature_header.split(","))
    timestamp = parts.get("t")
    signature = parts.get("v1")

    if not timestamp or not signature:
        raise ValueError("Missing signature components")

    if abs(time.time() - int(timestamp)) > tolerance:
        raise ValueError("Timestamp outside tolerance")

    expected = hmac.new(
        secret.encode(),
        f"{timestamp}.{raw_body}".encode(),
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected, signature):
        raise ValueError("Invalid signature")

    return json.loads(raw_body)