Webhooks

curl -X POST https://shelfforce.ai/api/v1/webhooks \
  -H "Authorization: Bearer sf_live_a1b2c3d4..." \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com/webhooks/shelfforce",
    "events": ["analysis.completed", "analysis.failed"],
    "description": "Production analysis handler"
  }'

import express from "express";
import crypto from "crypto";

const app = express();
app.use(express.json({ verify: (req, _res, buf) => { (req as any).rawBody = buf; } }));

const WEBHOOK_SECRET = process.env.SHELFFORCE_WEBHOOK_SECRET!;

function verifySignature(rawBody: Buffer, signatureHeader: string): boolean {
  const parts = Object.fromEntries(
    signatureHeader.split(",").map((part) => {
      const [key, value] = part.split("=");
      return [key, value];
    })
  );

  const timestamp = parts["t"];
  const signature = parts["v1"];
  if (!timestamp || !signature) return false;

  // Reject requests older than 5 minutes
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp, 10)) > 300) return false;

  const signedPayload = `${timestamp}.${rawBody.toString()}`;
  const expected = crypto
    .createHmac("sha256", WEBHOOK_SECRET)
    .update(signedPayload)
    .digest("hex");

  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

app.post("/webhooks/shelfforce", (req, res) => {
  const signatureHeader = req.headers["x-shelfforce-signature"] as string;
  if (!verifySignature((req as any).rawBody, signatureHeader)) {
    return res.status(401).json({ error: "Invalid signature" });
  }

  // Respond immediately — process asynchronously
  res.status(200).json({ received: true });

  const { event, data } = req.body;

  switch (event) {
    case "analysis.completed":
      console.log(`Analysis ${data.generationId} completed with ${data.productCount} products`);
      // Fetch full results: GET /api/v1/analyses/{data.generationId}
      break;

    case "analysis.failed":
      console.error(`Analysis ${data.generationId} failed: ${data.error}`);
      break;

    case "task.created":
      console.log(`Task ${data.taskId} created: ${data.title}`);
      break;

    case "task.updated":
      console.log(`Task ${data.taskId} updated: ${data.updatedFields.join(", ")}`);
      break;

    case "task.completed":
      console.log(`Task ${data.taskId} completed — compliance: ${data.complianceScore}%`);
      break;
  }
});

app.listen(3000, () => console.log("Webhook receiver running on port 3000"));

import crypto from "crypto";

function verifyWebhookSignature(
  payload: string,
  signatureHeader: string,
  secret: string,
  toleranceSeconds = 300
): boolean {
  const parts = Object.fromEntries(
    signatureHeader.split(",").map((part) => {
      const [key, value] = part.split("=");
      return [key, value];
    })
  );

  const timestamp = parts["t"];
  const signature = parts["v1"];

  if (!timestamp || !signature) {
    return false;
  }

  // Check timestamp tolerance (prevent replay attacks)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp, 10)) > toleranceSeconds) {
    return false;
  }

  // Compute expected signature
  const signedPayload = `${timestamp}.${payload}`;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(signedPayload)
    .digest("hex");

  // Constant-time comparison
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

curl https://shelfforce.ai/api/v1/webhooks \
  -H "Authorization: Bearer sf_live_a1b2c3d4..."

curl -X DELETE https://shelfforce.ai/api/v1/webhooks/wh_abc123 \
  -H "Authorization: Bearer sf_live_a1b2c3d4..."