Webhooks

import hmac
import hashlib

def verify_webhook(payload_body: bytes, signature_header: str, secret: str) -> bool:
    """Verify a FastDrop webhook signature."""
    expected = hmac.new(
        secret.encode("utf-8"),
        payload_body,          # raw bytes, exactly as received
        hashlib.sha256,
    ).hexdigest()

    received = signature_header.replace("sha256=", "")
    return hmac.compare_digest(expected, received)

const crypto = require("crypto");

function verifyWebhook(payloadBody, signatureHeader, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(payloadBody)       // raw body, not the parsed object
    .digest("hex");

  const received = signatureHeader.replace("sha256=", "");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(received)
  );
}

from fastapi import FastAPI, Request, Response, HTTPException

app = FastAPI()
SECRET = "your_webhook_secret"
seen_events: set[str] = set()   # use Redis or a table in production

@app.post("/webhooks/fastdrop")
async def fastdrop_webhook(request: Request):
    body = await request.body()

    if not verify_webhook(body, request.headers.get("X-FastDrop-Signature", ""), SECRET):
        raise HTTPException(status_code=401, detail="bad signature")

    event = await request.json()

    # At-least-once delivery: the same event id can arrive more than once.
    if event["id"] in seen_events:
        return Response(status_code=200)
    seen_events.add(event["id"])

    if event["event"] == "job.completed":
        handle_result(event["data"]["job_id"], event["data"]["results"])
    elif event["event"] == "job.failed":
        handle_failure(event["data"]["job_id"], event["data"].get("error"))

    # Return 2xx promptly. Non-2xx or >15s is treated as a failure and retried.
    return Response(status_code=200)

const express = require("express");
const app = express();
const SECRET = process.env.FASTDROP_WEBHOOK_SECRET;
const seen = new Set();   // use Redis in production

// express.raw so the body stays verifiable.
app.post(
  "/webhooks/fastdrop",
  express.raw({ type: "application/json" }),
  (req, res) => {
    if (!verifyWebhook(req.body, req.headers["x-fastdrop-signature"], SECRET)) {
      return res.sendStatus(401);
    }

    const event = JSON.parse(req.body.toString());

    if (seen.has(event.id)) return res.sendStatus(200);
    seen.add(event.id);

    if (event.event === "job.completed") {
      handleResult(event.data.job_id, event.data.results);
    } else if (event.event === "job.failed") {
      handleFailure(event.data.job_id, event.data.error);
    }

    res.sendStatus(200);
  }
);