API Documentation

import crypto from 'crypto';
import express, { Request, Response } from 'express';

const app = express();
// Importante: capture o corpo bruto (Buffer) para validação HMAC
app.use(express.raw({ type: 'application/json' }));

const WEBHOOK_SECRET = process.env.FERIADOS_WEBHOOK_SECRET!; // whsec_...

function verifyWebhookSignature(
  rawBody: Buffer,
  signatureHeader: string,
  secret: string,
  toleranceSeconds = 300
): boolean {
  // 1. Extrair t e v1
  const elements = signatureHeader.split(',');
  const timestampPart = elements.find((el) => el.startsWith('t='));
  const signaturePart = elements.find((el) => el.startsWith('v1='));

  if (!timestampPart || !signaturePart) return false;

  const timestamp = parseInt(timestampPart.substring(2), 10);
  const signature = signaturePart.substring(3);

  // 2. Prevenir replay attacks (janela de 5 minutos)
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - timestamp) > toleranceSeconds) {
    return false;
  }

  // 3. Montar payload assinado: `${timestamp}.${rawBody}`
  const signedPayload = `${timestamp}.${rawBody.toString('utf-8')}`;

  // 4. Calcular HMAC-SHA256
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  // 5. Comparar de forma segura contra timing attacks
  const expectedBuffer = Buffer.from(expectedSignature, 'utf-8');
  const actualBuffer = Buffer.from(signature, 'utf-8');

  if (expectedBuffer.length !== actualBuffer.length) return false;
  return crypto.timingSafeEqual(expectedBuffer, actualBuffer);
}

app.post('/api/webhook-feriados', (req: Request, res: Response) => {
  const signatureHeader = req.headers['x-feriados-signature'] as string;

  if (!signatureHeader || !verifyWebhookSignature(req.body, signatureHeader, WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Assinatura inválida' });
  }

  const payload = JSON.parse(req.body.toString('utf-8'));
  console.log('Evento recebido com sucesso:', payload.event, payload.data);

  // Retorne status 2xx rapidamente (< 8s)
  return res.status(200).json({ received: true });
});

import os
import time
import hmac
import hashlib
from fastapi import FastAPI, Request, HTTPException, status

app = FastAPI()
WEBHOOK_SECRET = os.environ.get("FERIADOS_WEBHOOK_SECRET")  # whsec_...

def verify_signature(raw_body: bytes, header_val: str, secret: str, tolerance: int = 300) -> bool:
    if not header_val or not secret:
        return False

    parts = dict(item.split("=", 1) for item in header_val.split(",") if "=" in item)
    timestamp_str = parts.get("t")
    signature = parts.get("v1")

    if not timestamp_str or not signature:
        return False

    # 1. Prevenir Replay Attack (5 minutos)
    timestamp = int(timestamp_str)
    if abs(time.time() - timestamp) > tolerance:
        return False

    # 2. Montar string assinada: timestamp.raw_body
    signed_payload = f"{timestamp}.".encode("utf-8") + raw_body

    # 3. Calcular HMAC-SHA256
    expected_sig = hmac.new(
        secret.encode("utf-8"),
        signed_payload,
        hashlib.sha256
    ).hexdigest()

    # 4. Comparação em tempo constante
    return hmac.compare_digest(expected_sig, signature)

@app.post("/api/webhook-feriados")
async def handle_webhook(request: Request):
    sig_header = request.headers.get("x-feriados-signature")
    body = await request.body()

    if not sig_header or not verify_signature(body, sig_header, WEBHOOK_SECRET):
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Assinatura inválida"
        )

    data = await request.json()
    print(f"Evento recebido com sucesso: {data['event']}")
    
    # Retorne status 2xx rapidamente (< 8s)
    return {"received": True}