Webhooks

import hashlib, hmac, json, os, time
from flask import Flask, request

app = Flask(__name__)
TOLERANCE = 300  # seconds


def verify(raw_body: bytes, header: str, secret: str) -> dict:
    parts = dict(p.split("=", 1) for p in header.split(","))
    timestamp = int(parts["t"])
    if abs(time.time() - timestamp) > TOLERANCE:
        raise ValueError("timestamp outside tolerance")

    expected = hmac.new(
        secret.encode(),
        f"{timestamp}.".encode() + raw_body,
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected, parts.get("v1", "")):
        raise ValueError("signature mismatch")
    return json.loads(raw_body)


@app.post("/webhooks/sphoro")
def handle():
    try:
        # request.get_data() is the raw bytes; request.json is not.
        event = verify(
            request.get_data(),
            request.headers["VoiceAI-Signature"],
            os.environ["SPHORO_WEBHOOK_SECRET"],
        )
    except (ValueError, KeyError):
        return "", 400

    if event["type"] == "call.ended":
        enqueue_followup(event["call_id"])
    return "", 204

const tolerance = 5 * time.Minute

func verify(rawBody []byte, header, secret string) (map[string]any, error) {
    var timestamp, signature string
    for _, part := range strings.Split(header, ",") {
        k, v, _ := strings.Cut(part, "=")
        switch k {
        case "t":
            timestamp = v
        case "v1":
            signature = v
        }
    }

    sent, err := strconv.ParseInt(timestamp, 10, 64)
    if err != nil || time.Since(time.Unix(sent, 0)).Abs() > tolerance {
        return nil, errors.New("timestamp outside tolerance")
    }

    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(timestamp + "."))
    mac.Write(rawBody)
    expected := hex.EncodeToString(mac.Sum(nil))

    if !hmac.Equal([]byte(expected), []byte(signature)) {
        return nil, errors.New("signature mismatch")
    }

    var event map[string]any
    return event, json.Unmarshal(rawBody, &event)
}

func handle(w http.ResponseWriter, r *http.Request) {
    // The raw bytes, before anything decodes them.
    body, err := io.ReadAll(io.LimitReader(r.Body, 1<<20))
    if err != nil {
        w.WriteHeader(http.StatusBadRequest)
        return
    }

    event, err := verify(body, r.Header.Get("VoiceAI-Signature"), os.Getenv("SPHORO_WEBHOOK_SECRET"))
    if err != nil {
        w.WriteHeader(http.StatusBadRequest)
        return
    }

    w.WriteHeader(http.StatusNoContent)
    if event["type"] == "call.ended" {
        go followUp(event["call_id"].(string))
    }
}

static final long TOLERANCE = 300; // seconds

static boolean verify(byte[] rawBody, String header, String secret) throws Exception {
    Map<String, String> parts = new HashMap<>();
    for (String part : header.split(",")) {
        String[] kv = part.split("=", 2);
        parts.put(kv[0], kv[1]);
    }

    long timestamp = Long.parseLong(parts.get("t"));
    if (Math.abs(Instant.now().getEpochSecond() - timestamp) > TOLERANCE) {
        return false;
    }

    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(secret.getBytes(UTF_8), "HmacSHA256"));
    mac.update((timestamp + ".").getBytes(UTF_8));
    byte[] expected = mac.doFinal(rawBody);

    return MessageDigest.isEqual(expected, HexFormat.of().parseHex(parts.get("v1")));
}

// In the handler — getInputStream(), not a parsed body:
byte[] body = request.getInputStream().readAllBytes();
if (!verify(body, request.getHeader("VoiceAI-Signature"), System.getenv("SPHORO_WEBHOOK_SECRET"))) {
    response.setStatus(400);
    return;
}
response.setStatus(204);