Webhooks

import crypto from 'crypto';

/**
 * Verify an Arcus webhook request.
 * @param {string | Buffer} rawBody  The raw request body (before JSON.parse).
 * @param {string}          signature  The Arcus-Signature header value.
 * @param {string}          secret  The signing secret (whsec_... from endpoint creation).
 * @throws {Error} if the signature is invalid or the timestamp is stale.
 */
function verifyArcusWebhook(rawBody, signature, secret) {
  const parts = Object.fromEntries(
    signature.split(',').map((p) => p.split('=', 2))
  );
  const timestamp = parts['t'];
  const receivedSig = parts['v1'];

  if (!timestamp || !receivedSig) {
    throw new Error('Malformed Arcus-Signature header');
  }

  const payload = `${timestamp}.${rawBody}`;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  const sigBuf = Buffer.from(receivedSig, 'hex');
  const expBuf = Buffer.from(expected, 'hex');

  if (sigBuf.length !== expBuf.length || !crypto.timingSafeEqual(sigBuf, expBuf)) {
    throw new Error('Invalid webhook signature');
  }

  // Reject events older than 5 minutes (replay protection)
  const age = Math.floor(Date.now() / 1000) - parseInt(timestamp, 10);
  if (age > 300) {
    throw new Error('Webhook timestamp too old (> 5 minutes)');
  }
}

// Express example -- use express.raw() to preserve the raw body
app.post('/arcus-webhook', express.raw({ type: 'application/json' }), (req, res) => {
  try {
    verifyArcusWebhook(req.body, req.headers['arcus-signature'], process.env.ARCUS_WEBHOOK_SECRET);
  } catch (err) {
    return res.status(400).send(err.message);
  }

  const event = JSON.parse(req.body);
  // Process event...
  res.status(200).send('ok');
});

import hashlib
import hmac
import time
import json

def verify_arcus_webhook(raw_body: bytes, signature: str, secret: str) -> None:
    """
    Verify an Arcus webhook request.

    Args:
        raw_body: The raw request body bytes (before JSON parsing).
        signature: The Arcus-Signature header value.
        secret: The signing secret (whsec_... from endpoint creation).

    Raises:
        ValueError: if the signature is invalid or the timestamp is stale.
    """
    parts = dict(p.split('=', 1) for p in signature.split(','))
    timestamp = parts.get('t')
    received_sig = parts.get('v1')

    if not timestamp or not received_sig:
        raise ValueError('Malformed Arcus-Signature header')

    payload = f"{timestamp}.{raw_body.decode('utf-8')}"
    expected = hmac.new(
        secret.encode('utf-8'),
        payload.encode('utf-8'),
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected, received_sig):
        raise ValueError('Invalid webhook signature')

    age = time.time() - int(timestamp)
    if age > 300:
        raise ValueError('Webhook timestamp too old (> 5 minutes)')


# Flask example
from flask import Flask, request, abort

app = Flask(__name__)

@app.route('/arcus-webhook', methods=['POST'])
def webhook():
    try:
        verify_arcus_webhook(
            request.data,
            request.headers.get('Arcus-Signature', ''),
            os.environ['ARCUS_WEBHOOK_SECRET'],
        )
    except ValueError as e:
        abort(400, str(e))

    event = request.get_json()
    # Process event...
    return '', 200

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "errors"
    "net/http"
    "os"
    "strconv"
    "strings"
    "time"
)

// VerifyArcusWebhook verifies an Arcus webhook request.
// rawBody is the raw request body bytes; signature is the Arcus-Signature header value;
// secret is the whsec_... signing secret from endpoint creation.
func VerifyArcusWebhook(rawBody []byte, signature, secret string) error {
    parts := make(map[string]string)
    for _, p := range strings.Split(signature, ",") {
        kv := strings.SplitN(p, "=", 2)
        if len(kv) == 2 {
            parts[kv[0]] = kv[1]
        }
    }

    timestamp := parts["t"]
    receivedSig := parts["v1"]
    if timestamp == "" || receivedSig == "" {
        return errors.New("malformed Arcus-Signature header")
    }

    payload := timestamp + "." + string(rawBody)
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(payload))
    expected := hex.EncodeToString(mac.Sum(nil))

    if !hmac.Equal([]byte(expected), []byte(receivedSig)) {
        return errors.New("invalid webhook signature")
    }

    ts, err := strconv.ParseInt(timestamp, 10, 64)
    if err != nil {
        return errors.New("invalid timestamp in Arcus-Signature header")
    }
    if time.Now().Unix()-ts > 300 {
        return errors.New("webhook timestamp too old (> 5 minutes)")
    }
    return nil
}

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    rawBody, _ := io.ReadAll(r.Body)
    if err := VerifyArcusWebhook(rawBody, r.Header.Get("Arcus-Signature"), os.Getenv("ARCUS_WEBHOOK_SECRET")); err != nil {
        http.Error(w, err.Error(), http.StatusBadRequest)
        return
    }
    // Process event...
    w.WriteHeader(http.StatusOK)
}