Webhooks - Payments API

#!/usr/bin/env node
// Minimal webhook handler using Node's built-in http server (no framework).
// Verify the signature on the RAW body, respond 2xx quickly (before any slow
// work), and dedupe on data.id -- deliveries are at-least-once and unordered.
import { createServer } from "node:http";
import { createHmac, timingSafeEqual } from "node:crypto";

const WEBHOOK_SECRET = process.env.RADIUMONE_WEBHOOK_SECRET ?? "";
const seenEventIds = new Set(); // replace with a persistent store in production

const SECRET_PATTERN = /^whsec_[0-9a-fA-F]{64}$/;
const SIGNATURE_HEX_PATTERN = /^[0-9a-fA-F]{64}$/;
const TIMESTAMP_PATTERN = /^\d+$/;

// Fails closed on every malformed input (missing header, bad secret shape,
// non-integer timestamp) -- never throws. See verify-webhook-signature for
// the fully-documented, standalone version of this function.
function verifySignature(secret, header, rawBody, toleranceSeconds = 300) {
  if (typeof secret !== "string" || !SECRET_PATTERN.test(secret)) return false;
  if (typeof header !== "string" || header.length === 0) return false;

  const fields = {};
  for (const part of header.split(",")) {
    const idx = part.indexOf("=");
    if (idx < 0) return false;
    fields[part.slice(0, idx)] = part.slice(idx + 1);
  }
  const { v, t, s } = fields;
  if (!v || !t || !s) return false;
  if (v !== "1") return false;
  if (!TIMESTAMP_PATTERN.test(t)) return false;
  if (!SIGNATURE_HEX_PATTERN.test(s)) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - Number(t)) > toleranceSeconds) return false;

  const key = Buffer.from(secret.slice("whsec_".length), "hex");
  const signingInput = Buffer.concat([Buffer.from(`${v}.${t}.`), rawBody]);
  const expectedHex = createHmac("sha256", key).update(signingInput).digest("hex");

  const expected = Buffer.from(expectedHex, "hex");
  const actual = Buffer.from(s, "hex");
  return expected.length === actual.length && timingSafeEqual(expected, actual);
}

const server = createServer((req, res) => {
  if (req.method !== "POST" || req.url !== "/webhooks/radiumone") {
    res.writeHead(404).end();
    return;
  }

  const chunks = [];
  req.on("data", (chunk) => chunks.push(chunk));
  req.on("end", () => {
    const rawBody = Buffer.concat(chunks); // verify against RAW bytes, not parsed JSON
    const header = req.headers["x-radiumone-signature"] ?? "";

    if (!verifySignature(WEBHOOK_SECRET, header, rawBody)) {
      res.writeHead(401).end();
      return;
    }

    const event = JSON.parse(rawBody.toString("utf8"));
    if (seenEventIds.has(event.id)) {
      res.writeHead(200).end(); // duplicate delivery: acknowledge, don't reprocess
      return;
    }
    seenEventIds.add(event.id);

    // Respond 2xx immediately; do slow work (DB writes, fulfilment) after
    // responding, e.g. via a queue. Never rely on the payload alone to
    // fulfil -- confirm amount and status match your order first.
    res.writeHead(200).end();
    console.log("received", event.type, event.id);
  });
});

server.listen(process.env.PORT ?? 3001);

#!/usr/bin/env python3
"""Minimal webhook handler using Python's built-in http.server (no framework).

Verify the signature on the RAW body, respond 2xx quickly (before any slow
work), and dedupe on ``data.id`` -- deliveries are at-least-once and
unordered.
"""
import hmac
import hashlib
import json
import os
import re
import time
from http.server import BaseHTTPRequestHandler, HTTPServer

WEBHOOK_SECRET = os.environ.get("RADIUMONE_WEBHOOK_SECRET", "")
SEEN_EVENT_IDS: set[str] = set()  # replace with a persistent store in production

_SECRET_PATTERN = re.compile(r"^whsec_[0-9a-fA-F]{64}$")
_SIGNATURE_HEX_PATTERN = re.compile(r"^[0-9a-fA-F]{64}$")
_TIMESTAMP_PATTERN = re.compile(r"^\d+$")


# Fails closed on every malformed input (missing header, bad secret shape,
# non-integer timestamp) -- never raises. See verify-webhook-signature for
# the fully-documented, standalone version of this function.
def verify_signature(secret: str, header: str, raw_body: bytes, tolerance_seconds: int = 300) -> bool:
    if not _SECRET_PATTERN.match(secret):
        return False
    if not header:
        return False

    fields = {}
    for part in header.split(","):
        if "=" not in part:
            return False
        k, _, v = part.partition("=")
        fields[k] = v

    v, t, s = fields.get("v"), fields.get("t"), fields.get("s")
    if not v or not t or not s:
        return False
    if v != "1":
        return False
    if not _TIMESTAMP_PATTERN.match(t):
        return False
    if not _SIGNATURE_HEX_PATTERN.match(s):
        return False
    if abs(int(time.time()) - int(t)) > tolerance_seconds:
        return False

    key = bytes.fromhex(secret[len("whsec_"):])
    signing_input = f"{v}.{t}.".encode("utf-8") + raw_body
    expected_hex = hmac.new(key, signing_input, hashlib.sha256).hexdigest()
    return hmac.compare_digest(bytes.fromhex(expected_hex), bytes.fromhex(s))


class WebhookHandler(BaseHTTPRequestHandler):
    def do_POST(self):
        if self.path != "/webhooks/radiumone":
            self.send_response(404)
            self.end_headers()
            return

        length = int(self.headers.get("Content-Length", 0))
        raw_body = self.rfile.read(length)  # verify against RAW bytes, not parsed JSON
        header = self.headers.get("X-RadiumOne-Signature", "")

        if not verify_signature(WEBHOOK_SECRET, header, raw_body):
            self.send_response(401)
            self.end_headers()
            return

        event = json.loads(raw_body)
        if event["id"] in SEEN_EVENT_IDS:
            self.send_response(200)  # duplicate delivery: acknowledge, don't reprocess
            self.end_headers()
            return
        SEEN_EVENT_IDS.add(event["id"])

        # Respond 2xx immediately; do slow work (DB writes, fulfilment) after
        # responding, e.g. via a queue. Never rely on the payload alone to
        # fulfil -- confirm amount and status match your order first.
        self.send_response(200)
        self.end_headers()
        print("received", event["type"], event["id"])


if __name__ == "__main__":
    HTTPServer(("", int(os.environ.get("PORT", 3001))), WebhookHandler).serve_forever()