Webhooks

// Aicscan webhook receiver (Node.js 18+, no dependency).
import crypto from 'node:crypto';
import http from 'node:http';

const SECRET = process.env.AICSCAN_WEBHOOK_SECRET; // whsec_…, shown when the channel is created
const TOLERANCE_SECONDS = 300;
const seen = new Set(); // in production: a shared table or cache, with expiry

export function verifySignature(secret, rawBody, timestamp, signature, now = Date.now() / 1000) {
  if (typeof timestamp !== 'string' || !/^\d+$/.test(timestamp)) return false;
  if (Math.abs(now - Number(timestamp)) > TOLERANCE_SECONDS) return false;
  const expected =
    'sha256=' +
    crypto.createHmac('sha256', secret).update(`${timestamp}.`).update(rawBody).digest('hex');
  const a = Buffer.from(expected);
  const b = Buffer.from(typeof signature === 'string' ? signature : '');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

const server = http.createServer((req, res) => {
  if (req.method !== 'POST') return res.writeHead(405).end();
  const chunks = [];
  req.on('data', (c) => chunks.push(c));
  req.on('end', () => {
    const raw = Buffer.concat(chunks); // raw body, before JSON.parse
    const ok = verifySignature(SECRET, raw, req.headers['x-timestamp'], req.headers['x-signature']);
    if (!ok) return res.writeHead(401).end();

    const eventId = req.headers['x-event-id'];
    if (seen.has(eventId)) return res.writeHead(200).end(); // retry already processed
    seen.add(eventId);

    const event = JSON.parse(raw);
    console.log(event.type, event.stage, event.severity, event.title);
    res.writeHead(204).end(); // answer within 10 s; process afterwards if needed
  });
});
server.listen(process.env.PORT ?? 3000);

# Aicscan webhook receiver (Python 3.9+, standard library only).
import hashlib
import hmac
import json
import os
import time
from http.server import BaseHTTPRequestHandler, HTTPServer

SECRET = os.environ["AICSCAN_WEBHOOK_SECRET"]  # whsec_…
TOLERANCE_SECONDS = 300
seen = set()  # in production: a shared table or cache, with expiry


def verify_signature(secret, raw_body, timestamp, signature, now=None):
    if not timestamp or not timestamp.isdigit():
        return False
    now = time.time() if now is None else now
    if abs(now - int(timestamp)) > TOLERANCE_SECONDS:
        return False
    mac = hmac.new(secret.encode(), timestamp.encode() + b"." + raw_body, hashlib.sha256)
    return hmac.compare_digest("sha256=" + mac.hexdigest(), signature or "")


class Handler(BaseHTTPRequestHandler):
    def do_POST(self):
        raw = self.rfile.read(int(self.headers.get("Content-Length", 0)))  # raw body
        if not verify_signature(SECRET, raw, self.headers.get("X-Timestamp"), self.headers.get("X-Signature")):
            self.send_response(401)
            self.end_headers()
            return
        event_id = self.headers.get("X-Event-Id")
        if event_id not in seen:  # a retry can arrive twice
            seen.add(event_id)
            event = json.loads(raw)
            print(event["type"], event["stage"], event["severity"], event["title"])
        self.send_response(204)
        self.end_headers()


if __name__ == "__main__":
    HTTPServer(("", int(os.environ.get("PORT", "3000"))), Handler).serve_forever()

<?php
// Aicscan webhook receiver (PHP 8+, no dependency).
declare(strict_types=1);

const TOLERANCE_SECONDS = 300;

function verify_signature(string $secret, string $rawBody, ?string $timestamp, ?string $signature, ?int $now = null): bool
{
    if ($timestamp === null || !ctype_digit($timestamp)) {
        return false;
    }
    $now ??= time();
    if (abs($now - (int) $timestamp) > TOLERANCE_SECONDS) {
        return false;
    }
    $expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    return hash_equals($expected, $signature ?? '');
}

$raw = file_get_contents('php://input'); // raw body, before json_decode
$ok = verify_signature(
    getenv('AICSCAN_WEBHOOK_SECRET'),
    $raw,
    $_SERVER['HTTP_X_TIMESTAMP'] ?? null,
    $_SERVER['HTTP_X_SIGNATURE'] ?? null
);
if (!$ok) {
    http_response_code(401);
    exit;
}

$eventId = $_SERVER['HTTP_X_EVENT_ID'] ?? '';
// Skip an $eventId you already processed (e.g. a table with a unique constraint).
$event = json_decode($raw, true, 512, JSON_THROW_ON_ERROR);
error_log("{$event['type']} {$event['stage']} {$event['severity']} {$event['title']}");
http_response_code(204);

// Aicscan webhook receiver (Go 1.20+, standard library only).
package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"io"
	"log"
	"net/http"
	"os"
	"strconv"
	"sync"
	"time"
)

const toleranceSeconds = 300

func verifySignature(secret string, rawBody []byte, timestamp, signature string, now time.Time) bool {
	ts, err := strconv.ParseUint(timestamp, 10, 64)
	if err != nil {
		return false
	}
	if d := now.Unix() - int64(ts); d > toleranceSeconds || d < -toleranceSeconds {
		return false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(timestamp + "."))
	mac.Write(rawBody)
	expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
	return hmac.Equal([]byte(expected), []byte(signature))
}

var (
	mu   sync.Mutex
	seen = map[string]bool{} // in production: a shared table or cache, with expiry
)

func handler(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		w.WriteHeader(http.StatusMethodNotAllowed)
		return
	}
	raw, err := io.ReadAll(io.LimitReader(r.Body, 1<<20)) // raw body
	if err != nil {
		w.WriteHeader(http.StatusBadRequest)
		return
	}
	secret := os.Getenv("AICSCAN_WEBHOOK_SECRET")
	if !verifySignature(secret, raw, r.Header.Get("X-Timestamp"), r.Header.Get("X-Signature"), time.Now()) {
		w.WriteHeader(http.StatusUnauthorized)
		return
	}
	id := r.Header.Get("X-Event-Id")
	mu.Lock()
	dup := seen[id]
	seen[id] = true
	mu.Unlock()
	if !dup {
		var event struct{ Type, Stage, Severity, Title string }
		if err := json.Unmarshal(raw, &event); err == nil {
			log.Println(event.Type, event.Stage, event.Severity, event.Title)
		}
	}
	w.WriteHeader(http.StatusNoContent)
}

func main() {
	port := os.Getenv("PORT")
	if port == "" {
		port = "3000"
	}
	http.HandleFunc("/", handler)
	log.Fatal(http.ListenAndServe(":"+port, nil))
}