Webhook Integration

import hmac
import hashlib
import time
import json
from flask import Flask, request, jsonify

app = Flask(__name__)

def verify_webhook(raw_body: bytes, signature_header: str, secret: str) -> bool:
    """Verify stryhub webhook signature."""
    # Parse the signature header
    parts = {}
    for part in signature_header.split(','):
        key, value = part.split('=', 1)
        parts[key] = value

    timestamp = parts.get('t', '')
    signature = parts.get('v1', '')

    # Construct signed content
    signed_content = f"{timestamp}.{raw_body.decode('utf-8')}"

    # Compute expected signature
    expected = hmac.new(
        secret.encode('utf-8'),
        signed_content.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()

    # Compare signatures (timing-safe)
    is_valid = hmac.compare_digest(signature, expected)

    # Check timestamp freshness (5 min tolerance)
    age = int(time.time()) - int(timestamp)
    if age > 300:
        raise ValueError('Webhook timestamp too old')

    return is_valid


@app.route('/webhooks/stryhub', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Stryhub-Signature', '')
    secret = os.environ['STRYHUB_WEBHOOK_SECRET']

    try:
        is_valid = verify_webhook(request.data, signature, secret)
        if not is_valid:
            return jsonify({'error': 'Invalid signature'}), 401

        event = json.loads(request.data)
        print(f"Received event: {event['type']} {event['id']}")

        # Handle the event
        if event['type'] == 'payment.completed':
            # Activate subscription, send welcome email, etc.
            pass
        elif event['type'] == 'subscription.canceled':
            # Revoke access, send retention email, etc.
            pass

        return jsonify({'received': True}), 200

    except Exception as e:
        print(f"Webhook error: {e}")
        return jsonify({'error': str(e)}), 400

<?php
// PHP webhook handler

function verifyWebhook(string $rawBody, string $signatureHeader, string $secret): bool
{
    // Parse the signature header
    $parts = [];
    foreach (explode(',', $signatureHeader) as $part) {
        [$key, $value] = explode('=', $part, 2);
        $parts[$key] = $value;
    }

    $timestamp = $parts['t'] ?? '';
    $signature = $parts['v1'] ?? '';

    // Construct signed content
    $signedContent = "{$timestamp}.{$rawBody}";

    // Compute expected signature
    $expected = hash_hmac('sha256', $signedContent, $secret);

    // Compare signatures (timing-safe)
    $isValid = hash_equals($signature, $expected);

    // Check timestamp freshness (5 min tolerance)
    $age = time() - intval($timestamp);
    if ($age > 300) {
        throw new Exception('Webhook timestamp too old');
    }

    return $isValid;
}

// Handle the webhook
$rawBody = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_STRYHUB_SIGNATURE'] ?? '';
$secret = getenv('STRYHUB_WEBHOOK_SECRET');

try {
    $isValid = verifyWebhook($rawBody, $signature, $secret);

    if (!$isValid) {
        http_response_code(401);
        echo json_encode(['error' => 'Invalid signature']);
        exit;
    }

    $event = json_decode($rawBody, true);
    error_log("Received event: {$event['type']} {$event['id']}");

    // Handle the event
    switch ($event['type']) {
        case 'payment.completed':
            // Activate subscription, send welcome email, etc.
            break;
        case 'subscription.canceled':
            // Revoke access, send retention email, etc.
            break;
    }

    http_response_code(200);
    echo json_encode(['received' => true]);

} catch (Exception $e) {
    error_log("Webhook error: " . $e->getMessage());
    http_response_code(400);
    echo json_encode(['error' => $e->getMessage()]);
}
?>