Webhooks

const crypto = require('crypto');

function validateWebhookSignature(body, signature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(typeof body === 'string' ? body : JSON.stringify(body))
    .digest('hex');
  
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// No seu handler Express:
app.post('/webhook/socialsell', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-socialsell-signature'];
  const secret = process.env.SOCIALSELL_WEBHOOK_SECRET;
  
  if (!validateWebhookSignature(req.body, signature, secret)) {
    return res.status(401).send('Assinatura inválida');
  }
  
  const event = JSON.parse(req.body);
  
  switch (event.event) {
    case 'deal.won':
      // processar negócio ganho
      break;
    case 'contact.created':
      // processar novo contato
      break;
  }
  
  res.status(200).send('OK');
});

import hmac
import hashlib
import os
from flask import Flask, request, abort

app = Flask(__name__)

def validate_signature(body, signature, secret):
    expected = 'sha256=' + hmac.new(
        secret.encode(),
        body,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

@app.route('/webhook/socialsell', methods=['POST'])
def webhook():
    signature = request.headers.get('X-SocialSell-Signature', '')
    secret = os.environ['SOCIALSELL_WEBHOOK_SECRET']
    
    if not validate_signature(request.data, signature, secret):
        abort(401)
    
    event = request.json
    
    if event['event'] == 'deal.won':
        # processar negócio ganho
        pass
    
    return 'OK', 200