Webhooks

import crypto from 'node:crypto';
import express from 'express';

app.post('/webhooks/recurso', 
  express.raw({ type: 'application/json' }),
  (req, res) => {
    // Verify manually — the SDKs ship no constructEvent helper.
    // Recompute HMAC-SHA256 (hex) over the RAW body with your
    // endpoint's signing secret and compare in constant time.
    const signature = req.headers['x-recurso-signature'];
    const expected = crypto
      .createHmac('sha256', process.env.WEBHOOK_SECRET)
      .update(req.body) // raw Buffer — never JSON.stringify
      .digest('hex');
    const valid =
      typeof signature === 'string' &&
      signature.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

    if (!valid) {
      console.error('Webhook signature verification failed');
      return res.sendStatus(400);
    }

    const event = JSON.parse(req.body);
    switch (event.type) {
      case 'subscription.created':
        handleSubscriptionActivated(event.data);
        break;
      case 'payment.failed':
        handlePaymentFailed(event.data);
        break;
    }

    res.sendStatus(200);
  }
);

import hashlib, hmac, json, os
from flask import Flask, request

@app.route('/webhooks/recurso', methods=['POST'])
def webhook():
    # Verify manually — the SDKs ship no construct_event helper.
    signature = request.headers.get('X-Recurso-Signature', '')
    expected = hmac.new(
        os.environ['WEBHOOK_SECRET'].encode(),
        request.get_data(),  # raw body, before any JSON parsing
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        return 'Invalid signature', 400

    event = json.loads(request.get_data())
    if event['type'] == 'subscription.created':
        handle_activation(event['data'])

    return '', 200