Webhooks

import express from "express";
import { Moosyl, WebhookSignatureError } from "moosyl-sdk";

const app = express();
// Verifying a webhook doesn't call the API, so any of your keys works here.
const moosyl = new Moosyl(process.env.MOOSYL_SECRET_KEY!);

app.post("/webhooks/moosyl", express.raw({ type: "application/json" }), async (req, res) => {
  let webhook;
  try {
    webhook = moosyl.constructWebhookEvent(
      req.body, // raw Buffer
      req.header("x-webhook-signature"),
      process.env.MOOSYL_WEBHOOK_SECRET!
    );
  } catch (error) {
    if (error instanceof WebhookSignatureError) {
      return res.status(401).send("Invalid signature");
    }
    throw error;
  }

  if (webhook.event === "payment-created" || webhook.event === "payment-updated") {
    if (webhook.data.status === "completed") {
      await markOrderPaid(webhook.data.transactionId);
    }
  }

  res.json({ received: true });
});

import crypto from "node:crypto";
import express from "express";

const app = express();

function isValidSignature(rawBody, header, secret) {
  if (!header?.startsWith("sha256=")) return false;
  const expected = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const received = header.slice("sha256=".length);
  return (
    received.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected))
  );
}

app.post("/webhooks/moosyl", express.raw({ type: "application/json" }), async (req, res) => {
  const signature = req.header("x-webhook-signature");
  if (!isValidSignature(req.body, signature, process.env.MOOSYL_WEBHOOK_SECRET)) {
    return res.status(401).send("Invalid signature");
  }

  const { event, data } = JSON.parse(req.body.toString("utf8"));
  if ((event === "payment-created" || event === "payment-updated") && data.status === "completed") {
    await markOrderPaid(data.transactionId);
  }

  res.json({ received: true });
});

import hashlib
import hmac
import os

from flask import Flask, abort, request

app = Flask(__name__)


def is_valid_signature(raw_body: bytes, header: str | None, secret: str) -> bool:
    if not header or not header.startswith("sha256="):
        return False
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(header[len("sha256="):], expected)


@app.post("/webhooks/moosyl")
def moosyl_webhook():
    raw_body = request.get_data()  # raw bytes, before JSON parsing
    if not is_valid_signature(raw_body, request.headers.get("x-webhook-signature"),
                              os.environ["MOOSYL_WEBHOOK_SECRET"]):
        abort(401)

    payload = request.get_json()
    if payload["event"] in ("payment-created", "payment-updated") \
            and payload["data"]["status"] == "completed":
        mark_order_paid(payload["data"]["transactionId"])

    return {"received": True}

<?php
$rawBody = file_get_contents('php://input');
$header = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$secret = getenv('MOOSYL_WEBHOOK_SECRET');

$expected = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);
if (!hash_equals($expected, $header)) {
    http_response_code(401);
    exit('Invalid signature');
}

$payload = json_decode($rawBody, true);
if (in_array($payload['event'], ['payment-created', 'payment-updated'], true)
    && $payload['data']['status'] === 'completed') {
    markOrderPaid($payload['data']['transactionId']);
}

http_response_code(200);
echo json_encode(['received' => true]);