Webhooks setup

import crypto from "node:crypto";
import express from "express";

const app = express();

// IMPORTANT: read the raw body. JSON re-serialization breaks signatures.
app.post(
  "/webhooks/openfx",
  express.raw({ type: "application/json" }),
  async (req, res) => {
    const sigHeader = req.header("x-openfx-signature");

    // Parse the timestamp + HMAC from the header: "t=<unix>,v1=<hex>"
    const parts = Object.fromEntries(
      (sigHeader ?? "").split(",").map((p) => p.split("=")),
    );
    const timestamp = parts["t"];
    const receivedHmac = parts["v1"];

    if (!timestamp || !receivedHmac) {
      return res.status(401).end();
    }

    // Replay window: reject events timestamped more than 5 minutes ago.
    if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
      return res.status(401).end();
    }

    const payload = `${timestamp}.${req.body.toString("utf8")}`;
    const expected = crypto
      .createHmac("sha256", process.env.OPENFX_WEBHOOK_SECRET)
      .update(payload)
      .digest("hex");

    const a = Buffer.from(receivedHmac);
    const b = Buffer.from(expected);
    // timingSafeEqual throws on length mismatch — guard first.
    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.status(401).end();
    }

    const event = JSON.parse(req.body.toString("utf8"));

    // Idempotent processing — events can be redelivered. Dedupe by event id.
    if (await store.alreadyProcessed(event.id)) {
      return res.status(200).end();
    }

    // event.type is the resource noun, e.g. "deposits" or "withdrawals"
    // event.eventType is the dotted action, e.g. "deposit.completed"
    // event.data is the single resource object.
    await dispatch(event);
    await store.markProcessed(event.id);

    res.status(200).end();
  },
);

import hashlib, hmac, os, time
from flask import Flask, request

app = Flask(__name__)

@app.post('/webhooks/openfx')
def openfx_webhook():
    sig_header = request.headers.get('x-openfx-signature', '')

    # Parse "t=<unix>,v1=<hex>"
    parts = dict(p.split('=', 1) for p in sig_header.split(',') if '=' in p)
    timestamp = parts.get('t')
    received_hmac = parts.get('v1')

    if not timestamp or not received_hmac:
        return '', 401

    # Replay window: reject events timestamped more than 5 minutes ago.
    if abs(time.time() - float(timestamp)) > 300:
        return '', 401

    raw_body = request.get_data()
    signed_payload = f"{timestamp}.{raw_body.decode('utf-8')}".encode()
    expected = hmac.new(
        os.environ['OPENFX_WEBHOOK_SECRET'].encode(),
        signed_payload,
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(received_hmac, expected):
        return '', 401

    event = request.get_json(force=True)

    # Dedupe by event id
    if store.already_processed(event['id']):
        return '', 200

    dispatch(event)
    store.mark_processed(event['id'])
    return '', 200