Webhooks

import express from "express";
import { Constaia, WebhookVerificationError, type WebhookEvent } from "@constaia/sdk";

const app = express();
const constaia = new Constaia();
const secret = process.env.CONSTAIA_WEBHOOK_SECRET!;

// express.raw: the body arrives as a Buffer, unparsed
app.post("/webhooks/constaia", express.raw({ type: "application/json" }), async (req, res) => {
  let event: WebhookEvent<any>;
  try {
    event = await constaia.webhooks.verify(req.body, req.headers, secret);
  } catch (err) {
    const status = err instanceof WebhookVerificationError ? 400 : 500;
    return res.sendStatus(status);
  }

  res.sendStatus(204);
  void handleEvent(req.header("webhook-id")!, event).catch(console.error);
});

async function handleEvent(deliveryId: string, event: WebhookEvent<any>) {
  // Deduplicate on deliveryId in your database before processing
  switch (event.type) {
    case "analysis.completed":
      console.log(deliveryId, event.data.id, event.data.verdict?.status);
      break;
    case "analysis.review_required":
      console.log("To review:", event.data.id);
      break;
    case "analysis.failed":
      console.log("Failed:", event.data.id, event.data.error?.code);
      break;
    case "batch.completed":
      console.log("Batch finished:", event.data.id, event.data.counts);
      break;
    case "credits.low":
      console.log("Low balance:", event.data.credits_available);
      break;
  }
}

app.listen(3000);

import { createHmac, timingSafeEqual } from "node:crypto";

type Headers = Record<string, string | string[] | undefined>;

export function verifyConstaiaWebhook(rawBody: Buffer | string, headers: Headers, secret: string, tolerance = 300) {
  const get = (name: string) => {
    const value = headers[name];
    return Array.isArray(value) ? value[0] : value;
  };
  const id = get("webhook-id");
  const timestamp = get("webhook-timestamp");
  const signatures = get("webhook-signature");
  if (!id || !timestamp || !signatures) throw new Error("Missing webhook headers");

  const ts = Number(timestamp);
  if (!Number.isInteger(ts) || Math.abs(Date.now() / 1000 - ts) > tolerance) {
    throw new Error("webhook-timestamp outside tolerance");
  }

  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = Buffer.from(
    createHmac("sha256", key).update(`${id}.${timestamp}.`).update(rawBody).digest("base64"),
  );

  const valid = signatures.split(" ").some((entry) => {
    const [version, signature] = entry.split(",");
    if (version !== "v1" || !signature) return false;
    const received = Buffer.from(signature);
    return received.length === expected.length && timingSafeEqual(received, expected);
  });
  if (!valid) throw new Error("Invalid signature");

  return JSON.parse(rawBody.toString());
}

import { signWebhook } from "@constaia/sdk";

const secret = process.env.CONSTAIA_WEBHOOK_SECRET!;
const payload = JSON.stringify({
  type: "analysis.completed",
  created_at: new Date().toISOString(),
  data: { id: "an_test", object: "analysis", status: "completed", verdict: null, metadata: {} },
});

const headers = await signWebhook(payload, secret, { id: "msg_test_1" });
const res = await fetch("http://localhost:3000/webhooks/constaia", {
  method: "POST",
  headers: { ...headers, "content-type": "application/json" },
  body: payload,
});
console.log(res.status); // 204