Webhooks Throne

const crypto = require('crypto');

app.post('/throne/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const payload = req.body.toString();
  const signature = req.headers['x-throne-signature'];
  const expected = crypto.createHmac('sha256', process.env.THRONE_WEBHOOK_SECRET)
    .update(payload).digest('hex');

  if (! crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(payload);

  // Idempotência via Redis
  redis.setnx(`webhook:${event.event_id}`, 1).then(set => {
    if (! set) return res.send('already_processed');
    queue.add('throne-event', event);
    res.send('ok');
  });
});

import hmac, hashlib

@app.route('/throne/webhook', methods=['POST'])
def webhook():
    payload = request.get_data()
    signature = request.headers.get('X-Throne-Signature')
    expected = hmac.new(
        THRONE_WEBHOOK_SECRET.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(expected, signature):
        return 'invalid signature', 401

    event = json.loads(payload)
    # Idempotência via Redis
    if not redis.setnx(f'webhook:{event["event_id"]}', 1):
        return 'already_processed', 200

    process_throne_event.delay(event)  # Celery async
    return 'ok', 200

require 'openssl'
class ThroneWebhooksController < ApplicationController
  skip_before_action :verify_authenticity_token
  def receive
    payload = request.raw_post
    signature = request.headers['X-Throne-Signature']
    expected = OpenSSL::HMAC.hexdigest('SHA256', ENV['THRONE_WEBHOOK_SECRET'], payload)

    return head(:unauthorized) unless ActiveSupport::SecurityUtils.secure_compare(signature, expected)

    event = JSON.parse(payload)
    return head(:ok) if WebhookProcessed.exists?(event_id: event['event_id'])

    ThroneEventJob.perform_later(event)
    WebhookProcessed.create!(event_id: event['event_id'])
    head :ok
  end
end

import ("crypto/hmac"; "crypto/sha256"; "encoding/hex")

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    payload, _ := io.ReadAll(r.Body)
    signature := r.Header.Get("X-Throne-Signature")

    mac := hmac.New(sha256.New, []byte(os.Getenv("THRONE_WEBHOOK_SECRET")))
    mac.Write(payload)
    expected := hex.EncodeToString(mac.Sum(nil))

    if ! hmac.Equal([]byte(signature), []byte(expected)) {
        http.Error(w, "invalid signature", http.StatusUnauthorized)
        return
    }

    var event ThroneEvent
    json.Unmarshal(payload, &event)

    // Idempotência via Redis SETNX
    set, _ := redisClient.SetNX(ctx, "webhook:"+event.EventID, 1, 0).Result()
    if ! set { fmt.Fprint(w, "already_processed"); return }

    go processEvent(event)
    fmt.Fprint(w, "ok")
}

@RestController
public class ThroneWebhookController {
    @PostMapping("/throne/webhook")
    public ResponseEntity<String> handle(@RequestBody byte[] payload, @RequestHeader("X-Throne-Signature") String sig) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(System.getenv("THRONE_WEBHOOK_SECRET").getBytes(), "HmacSHA256"));
        String expected = HexFormat.of().formatHex(mac.doFinal(payload));

        if (! MessageDigest.isEqual(sig.getBytes(), expected.getBytes())) {
            return ResponseEntity.status(401).body("invalid");
        }

        ThroneEvent event = objectMapper.readValue(payload, ThroneEvent.class);
        eventService.processAsync(event);
        return ResponseEntity.ok("ok");
    }
}