Webhooks

{
  "id": "evt_abc123",
  "type": "task.completed",
  "created_at": "2025-01-15T10:00:45Z",
  "data": {
    "task": {
      "id": "task_abc123",
      "type": "video",
      "status": "succeeded",
      "provider": "vidu",
      "model": "viduq3-turbo",
      "result": [
        {
          "url": "https://cdn.modelhunter.ai/results/task_abc123.mp4?signature=xxx",
          "duration": 4,
          "format": "mp4",
          "size_bytes": 12582912
        }
      ],
      "created_at": "2025-01-15T10:00:00Z",
      "completed_at": "2025-01-15T10:00:45Z",
      "metadata": { "user_id": "u_123" }
    }
  }
}

{
  "id": "evt_def456",
  "type": "task.failed",
  "created_at": "2025-01-15T10:00:10Z",
  "data": {
    "task": {
      "id": "task_def456",
      "type": "video",
      "status": "failed",
      "provider": "vidu",
      "model": "viduq3-turbo",
      "error": {
        "code": "PROVIDER_ERROR",
        "message": "Content policy violation"
      },
      "created_at": "2025-01-15T10:00:00Z",
      "completed_at": "2025-01-15T10:00:10Z"
    }
  }
}

import crypto from "crypto";

function verifyWebhookSignature(req, secret) {
  const timestamp = req.headers["x-webhook-timestamp"];
  const signature = req.headers["x-webhook-signature"];
  const body = JSON.stringify(req.body);

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${body}`)
    .digest("hex");

  const expectedSignature = `sha256=${expected}`;

  if (signature !== expectedSignature) {
    throw new Error("Invalid webhook signature");
  }

  // Reject timestamps older than 5 minutes
  const age = Math.floor(Date.now() / 1000) - parseInt(timestamp, 10);
  if (age > 300) {
    throw new Error("Webhook timestamp too old");
  }

  return true;
}

import hmac
import hashlib
import time
import json

def verify_webhook_signature(headers, body, secret):
    timestamp = headers["X-Webhook-Timestamp"]
    signature = headers["X-Webhook-Signature"]

    payload = f"{timestamp}.{json.dumps(body)}"
    expected = hmac.new(
        secret.encode(),
        payload.encode(),
        hashlib.sha256,
    ).hexdigest()

    expected_signature = f"sha256={expected}"

    if not hmac.compare_digest(signature, expected_signature):
        raise ValueError("Invalid webhook signature")

    # Reject timestamps older than 5 minutes
    age = int(time.time()) - int(timestamp)
    if age > 300:
        raise ValueError("Webhook timestamp too old")

    return True