Products Webhook

from fastapi import FastAPI, Request, HTTPException
from pydantic import BaseModel
import hmac
import hashlib
import time

app = FastAPI()

WEBHOOK_SECRET = "your_webhook_secret"

def verify_signature(request: Request, body: bytes):
    sig_header = request.headers.get("x-vizochok-signature", "")
    timestamp = request.headers.get("x-vizochok-timestamp", "")

    if not sig_header.startswith("sha256="):
        raise HTTPException(401, "Missing signature")

    # Check timestamp (5-minute tolerance)
    if timestamp:
        if abs(time.time() - int(timestamp)) > 300:
            raise HTTPException(401, "Timestamp expired")
        signed_payload = f"{timestamp}.".encode() + body
    else:
        signed_payload = body

    expected = hmac.new(
        WEBHOOK_SECRET.encode(), signed_payload, hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(sig_header[7:], expected):
        raise HTTPException(401, "Invalid signature")


class CheckProductsRequest(BaseModel):
    skus: list[str]
    store_id: str


@app.post("/api/vizochok/check-products")
async def check_products(req: CheckProductsRequest, request: Request):
    body = await request.body()
    verify_signature(request, body)

    # Look up products in your database
    products = []
    for sku in req.skus:
        product = await db.get_product(sku, store_id=req.store_id)
        if product:
            item = {
                "sku": sku,
                "price": product.price,
                "in_stock": product.stock > 0,
            }
            if product.promo_price:
                item["promo_price"] = product.promo_price
                item["promo_label"] = product.promo_label
            products.append(item)

    return {"products": products}

const express = require('express');
const crypto = require('crypto');
const app = express();

const WEBHOOK_SECRET = 'your_webhook_secret';

// Parse raw body for signature verification
app.use('/api/vizochok', express.json({
  verify: (req, res, buf) => { req.rawBody = buf; }
}));

function verifySignature(req) {
  const sigHeader = req.headers['x-vizochok-signature'] || '';
  const timestamp = req.headers['x-vizochok-timestamp'] || '';

  if (!sigHeader.startsWith('sha256=')) {
    throw new Error('Missing signature');
  }

  // Check timestamp (5-minute tolerance)
  if (timestamp) {
    const ts = parseInt(timestamp, 10);
    if (Math.abs(Date.now() / 1000 - ts) > 300) {
      throw new Error('Timestamp expired');
    }
  }

  const signedPayload = timestamp
    ? Buffer.concat([Buffer.from(`${timestamp}.`), req.rawBody])
    : req.rawBody;

  const expected = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(signedPayload)
    .digest('hex');

  if (!crypto.timingSafeEqual(
    Buffer.from(sigHeader.slice(7)),
    Buffer.from(expected)
  )) {
    throw new Error('Invalid signature');
  }
}

app.post('/api/vizochok/check-products', async (req, res) => {
  try {
    verifySignature(req);
  } catch (err) {
    return res.status(401).json({ error: err.message });
  }

  const { skus, store_id } = req.body;

  // Look up products in your database
  const products = [];
  for (const sku of skus) {
    const product = await db.getProduct(sku, store_id);
    if (product) {
      const item = {
        sku,
        price: product.price,
        in_stock: product.stock > 0,
      };
      if (product.promoPrice) {
        item.promo_price = product.promoPrice;
        item.promo_label = product.promoLabel;
      }
      products.push(item);
    }
  }

  res.json({ products });
});