Webhooks setup

import crypto from "node:crypto";
import express from "express";

const app = express();
const TOLERANCE_SECONDS = 300;

// IMPORTANT: read the raw body. JSON re-serialization breaks signatures.
app.post(
  "/webhooks/openfx",
  express.raw({ type: "application/json" }),
  async (req, res) => {
    const sigHeader = req.header("x-openfx-signature");
    const fields = Object.fromEntries(
      (sigHeader || "")
        .split(",")
        .map((part) => part.split("="))
        .filter(([key, value]) => key && value),
    );
    if (!fields.t || !fields.v1) {
      return res.status(401).end();
    }

    const timestamp = Number(fields.t);
    const now = Math.floor(Date.now() / 1000);
    if (
      !Number.isFinite(timestamp) ||
      Math.abs(now - timestamp) > TOLERANCE_SECONDS
    ) {
      return res.status(401).end();
    }

    const expected = crypto
      .createHmac("sha256", process.env.OPENFX_WEBHOOK_SIGNING_KEY)
      .update(`${timestamp}.${req.body}`)
      .digest("hex");

    const a = Buffer.from(fields.v1);
    const b = Buffer.from(expected);
    // timingSafeEqual throws on length mismatch; guard first.
    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.status(401).end();
    }

    const event = JSON.parse(req.body.toString("utf8"));

    // Idempotent processing: events can be redelivered. Dedupe by event id.
    if (await store.alreadyProcessed(event.id)) {
      return res.status(200).end();
    }

    // event.type is the resource noun, e.g. "deposits" or "withdrawals"
    // event.eventType is the product-prefixed action, e.g. "fx.deposit.completed"
    // event.data is the single resource object.
    await dispatch(event);
    await store.markProcessed(event.id);

    res.status(200).end();
  },
);

import hashlib, hmac, os, time
from flask import Flask, request

app = Flask(__name__)
TOLERANCE_SECONDS = 300

@app.post('/webhooks/openfx')
def openfx_webhook():
    sig_header = request.headers.get('x-openfx-signature', '')
    fields = {}
    for part in sig_header.split(','):
        if '=' not in part:
            continue
        key, _, value = part.partition('=')
        if key and value:
            fields[key] = value
    if 't' not in fields or 'v1' not in fields:
        return '', 401

    try:
        timestamp = int(fields['t'])
    except ValueError:
        return '', 401
    if abs(time.time() - timestamp) > TOLERANCE_SECONDS:
        return '', 401

    raw_body = request.get_data()
    signed_payload = f"{timestamp}.".encode('utf-8') + raw_body
    expected = hmac.new(
        os.environ['OPENFX_WEBHOOK_SIGNING_KEY'].encode(),
        signed_payload,
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(fields['v1'], expected):
        return '', 401

    event = request.get_json(force=True)

    # Dedupe by event id
    if store.already_processed(event['id']):
        return '', 200

    dispatch(event)
    store.mark_processed(event['id'])
    return '', 200