Webhooks

import { webhooks } from "@crylabsorg/suward-sdk";
 
app.post("/webhooks/suward", express.raw({ type: "application/json" }), async (req, res) => {
  const body = req.body.toString("utf8");             // SDK takes a string, not the raw Buffer
  const ok = await webhooks.WebhooksHelper.verifySignature(
    body,
    req.header("X-Suward-Signature"),
    process.env.SUWARD_WEBHOOK_PUBLIC_KEY,
    req.header("X-Suward-Timestamp")
  );
  if (!ok) return res.status(400).send("bad signature");
 
  const event = JSON.parse(body);
  const resource = event.payment ?? event.staticDeposit;
 
  try {
    await store.transaction(async (tx) => {
      // INSERT … ON CONFLICT DO NOTHING against a UNIQUE index on eventId.
      // The mark and the work below commit together or not at all.
      if (!(await tx.claimEventId(event.eventId))) return;
 
      const known = await tx.loadState(resource.id);
      if (known && known.updatedAt >= resource.updatedAt) return;
 
      if (event.type === "payment.accepted") await fulfil(tx, event.payment);
      if (event.type === "payment.success") await settle(tx, event.payment);
      await tx.saveState(resource.id, resource);
    });
  } catch {
    return res.sendStatus(500);                       // nothing committed — ask for a retry
  }
 
  res.sendStatus(200);
});

package main
 
import (
  "context"
  "crypto/ed25519"
  "crypto/x509"
  "database/sql"
  "encoding/hex"
  "encoding/json"
  "encoding/pem"
  "errors"
  "io"
  "net/http"
  "os"
  "strconv"
  "strings"
  "time"
)
 
const replayWindow = 300 * time.Second
 
var publicKey ed25519.PublicKey
 
// eventStore is your database. Apply must run as ONE transaction: insert
// eventID into a table with a unique index, return without calling do when that
// insert conflicts or when the stored updatedAt is not older than updatedAt,
// and otherwise commit the mark together with everything do wrote.
type eventStore interface {
  Apply(ctx context.Context, eventID, resourceID string, updatedAt int64, do func(*sql.Tx) error) error
}
 
var store eventStore
 
type event struct {
  Type          string          `json:"type"`
  EventID       string          `json:"eventId"`
  Payment       json.RawMessage `json:"payment"`
  StaticDeposit json.RawMessage `json:"staticDeposit"`
}
 
type resourceState struct {
  ID        string `json:"id"`
  UpdatedAt int64  `json:"updatedAt"`
}
 
func init() {
  key, err := loadPublicKey(os.Getenv("SUWARD_WEBHOOK_PUBLIC_KEY"))
  if err != nil {
    panic(err)
  }
  publicKey = key
}
 
// loadPublicKey parses the PKIX/SPKI PEM block returned as project.webhookPublicKey.
func loadPublicKey(pemText string) (ed25519.PublicKey, error) {
  block, _ := pem.Decode([]byte(pemText))
  if block == nil {
    return nil, errors.New("webhookPublicKey is not a PEM block")
  }
  parsed, err := x509.ParsePKIXPublicKey(block.Bytes)
  if err != nil {
    return nil, err
  }
  key, ok := parsed.(ed25519.PublicKey)
  if !ok {
    return nil, errors.New("webhookPublicKey is not an Ed25519 key")
  }
  return key, nil
}
 
func fresh(timestampHeader string) bool {
  millis, err := strconv.ParseInt(timestampHeader, 10, 64)
  if err != nil {
    return false
  }
  age := time.Since(time.UnixMilli(millis))
  if age < 0 {
    age = -age
  }
  return age <= replayWindow
}
 
func handle(w http.ResponseWriter, r *http.Request) {
  body, _ := io.ReadAll(r.Body) // raw bytes — verify before parsing
 
  sig := strings.TrimPrefix(r.Header.Get("X-Suward-Signature"), "ed25519=")
  raw, err := hex.DecodeString(sig)
  if err != nil || !ed25519.Verify(publicKey, body, raw) {
    http.Error(w, "bad signature", http.StatusBadRequest)
    return
  }
 
  if !fresh(r.Header.Get("X-Suward-Timestamp")) {
    http.Error(w, "stale event", http.StatusBadRequest)
    return
  }
 
  var ev event
  if err := json.Unmarshal(body, &ev); err != nil {
    http.Error(w, "bad payload", http.StatusBadRequest)
    return
  }
 
  resource := ev.Payment
  if len(resource) == 0 {
    resource = ev.StaticDeposit
  }
  var state resourceState
  if err := json.Unmarshal(resource, &state); err != nil {
    http.Error(w, "bad payload", http.StatusBadRequest)
    return
  }
 
  err = store.Apply(r.Context(), ev.EventID, state.ID, state.UpdatedAt, func(tx *sql.Tx) error {
    switch ev.Type {
    case "payment.accepted":
      return fulfil(tx, ev.Payment)
    case "payment.success":
      return settle(tx, ev.Payment)
    }
    return nil
  })
  if err != nil {
    http.Error(w, "retry later", http.StatusInternalServerError)
    return
  }
 
  w.WriteHeader(http.StatusOK)
}

import json
import os
import time
 
from cryptography.exceptions import InvalidSignature
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
from cryptography.hazmat.primitives.serialization import load_pem_public_key
 
REPLAY_WINDOW_MS = 300_000
 
 
def load_public_key(public_key_pem: str) -> Ed25519PublicKey:
    key = load_pem_public_key(public_key_pem.encode())   # -----BEGIN PUBLIC KEY----- (PKIX/SPKI)
    if not isinstance(key, Ed25519PublicKey):
        raise ValueError("webhookPublicKey is not an Ed25519 key")
    return key
 
 
PUBLIC_KEY = load_public_key(os.environ["SUWARD_WEBHOOK_PUBLIC_KEY"])
 
 
def verify(raw_body: bytes, signature_header: str) -> bool:
    try:
        signature = bytes.fromhex(signature_header.removeprefix("ed25519="))
    except (AttributeError, ValueError):
        return False
 
    try:
        PUBLIC_KEY.verify(signature, raw_body)
    except InvalidSignature:
        return False
    return True
 
 
def fresh(timestamp_header: str) -> bool:
    try:
        sent_at = int(timestamp_header)
    except (TypeError, ValueError):
        return False
    return abs(time.time() * 1000 - sent_at) <= REPLAY_WINDOW_MS
 
 
def handle(raw_body: bytes, signature_header: str, timestamp_header: str) -> int:
    if not verify(raw_body, signature_header) or not fresh(timestamp_header):
        return 400
 
    event = json.loads(raw_body)
    resource = event.get("payment") or event["staticDeposit"]
 
    try:
        # db is your database. One transaction covers the eventId mark and the
        # work it guards; claim_event is an insert against a unique index.
        with db.transaction() as tx:
            if not tx.claim_event(event["eventId"]):
                return 200
 
            known = tx.load_state(resource["id"])
            if known and known["updatedAt"] >= resource["updatedAt"]:
                return 200
 
            if event["type"] == "payment.accepted":
                fulfil(tx, event["payment"])
            elif event["type"] == "payment.success":
                settle(tx, event["payment"])
            tx.save_state(resource["id"], resource)
    except Exception:
        return 500                                       # nothing committed — ask for a retry
 
    return 200