Webhooks

from fastapi import FastAPI, Request
import hashlib
import hmac

def verify_webhook(payload, secret):
    hash = hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(signagture, hash)

class WebhookPayload(pydantic.BaseModel):
    event: str
    app: str
    user_id: str | None
    source: str
    resource_id: str | None = None
    connection_id: str | None = None
    integration_id: str | None = None
    timestamp: int

app = FastAPI()

@router.post("/webhooks/hyperspell")
async def hyperspell_webhook(query: WebhookPayload, request: Request):
    # Verify that the request is from Hyperspell
    signature = request.headers.get("X-Hyperspell-Signature")
    if not verify_webhook(query, HYPERSPELL_JWT_SECRET):
        raise HTTPException(status_code=401, detail="Invalid signature")

    # Protect against replay attacks
    if query.timestamp < time.time() - 300:
        raise HTTPException(status_code=401, detail="Timestamp is too old")

    # Handle the webhook
    if query.event == "connection-created":
        # A user connected a new account
        ...
    elif query.event == "index-started":
        # A memory started indexing
        ...
    elif query.event == "index-completed":
        # A memory finished indexing
        ...

    return {"message": "Webhook received"}

// app/api/webhooks/hyperspell/route.ts
import { NextResponse } from "next/server";
import crypto from "node:crypto";
export const runtime = "nodejs";

type WebhookPayload = {
  event: "connection-created" | "index-started" | "index-completed" | string;
  app: string;
  user_id?: string | null;
  source: string;
  resource_id?: string | null;
  connection_id?: string | null;
  integration_id?: string | null;
  timestamp: number; // unix seconds
};

function verify_webhook(payload: WebhookPayload, secret: string) {
  const expected = crypto.createHmac("sha256", secret).update(payload).digest("hex");
  return hmac.compare_digest(sig, expected);
}

export async function POST(req: Request) {
  const secret = process.env.HYPERSPELL_WEBHOOK_SECRET!;
  const sig = (req.headers.get("x-hyperspell-signature") || "").toLowerCase();
  const raw = Buffer.from(await req.arrayBuffer());

  if (!verify_webhook(payload, secret)) return NextResponse.json({ error: "invalid_signature" }, { status: 401 });

  const payload = JSON.parse(raw.toString("utf8")) as WebhookPayload;

  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - payload.timestamp) > 300) { // 5 minutes
    return NextResponse.json({ error: "stale_or_future" }, { status: 401 });
  }

  switch (payload.event) {
    case "connection-created":
      // a user connected a new account
      break;
    case "index-started":
      // a memory started indexing
      break;
    case "index-completed":
      // a memory finished indexing
      break;
  }

  return NextResponse.json({ ok: true });
}