Webhooks

package main

import (
    "crypto/ecdsa"
    "crypto/sha256"
    "crypto/x509"
    "encoding/hex"
    "encoding/pem"
    "io"
    "log"
    "math/big"
    "net/http"
)

const publicKeyPEM = `-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWZrLPi5uAvrLKQ5mgWLXICH3bkk2
oXl2WZLGwKysLdYPdsyc7Dc3UOPPFPdQH5Mjp24kDjiCVztCeNYc/PqR7Q==
-----END PUBLIC KEY-----`

var publicKey *ecdsa.PublicKey

func main() {
    // Parse the public key once at startup
    var err error
    publicKey, err = parsePublicKey(publicKeyPEM)
    if err != nil {
        log.Fatalf("Failed to parse public key: %v", err)
    }

    http.HandleFunc("/webhook", handleWebhook)
    
    log.Println("Server starting on :8080")
    log.Fatal(http.ListenAndServe(":8080", nil))
}

func handleWebhook(w http.ResponseWriter, r *http.Request) {
    // Only accept POST requests
    if r.Method != http.MethodPost {
        http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
        return
    }

    // Read the signature from header
    signature := r.Header.Get("X-Signature")
    if signature == "" {
        http.Error(w, "Missing signature", http.StatusBadRequest)
        return
    }

    // Read the request body
    body, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "Failed to read request body", http.StatusBadRequest)
        return
    }
    defer r.Body.Close()

    // Verify the signature
    valid, err := verifySignature(body, signature)
    if err != nil {
        log.Printf("Signature verification error: %v", err)
        http.Error(w, "Invalid signature format", http.StatusBadRequest)
        return
    }

    if !valid {
        log.Printf("Invalid signature for payload: %s", string(body))
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }

    // Signature is valid, log the payload
    log.Printf("Received valid webhook: %s", string(body))
    w.WriteHeader(http.StatusOK)
}

func verifySignature(message []byte, signatureHex string) (bool, error) {
    // Decode the hex signature
    signature, err := hex.DecodeString(signatureHex)
    if err != nil {
        return false, err
    }

    // Signature should be exactly 64 bytes (r and s are 32 bytes each)
    if len(signature) != 64 {
        return false, err
    }

    // Split signature into r and s
    r := new(big.Int).SetBytes(signature[:32])
    s := new(big.Int).SetBytes(signature[32:])

    // Calculate the hash of the message
    hash := sha256.Sum256(message)

    // Verify the signature
    return ecdsa.Verify(publicKey, hash[:], r, s), nil
}

func parsePublicKey(pemKey string) (*ecdsa.PublicKey, error) {
    block, _ := pem.Decode([]byte(pemKey))
    if block == nil {
        return nil, err
    }

    pub, err := x509.ParsePKIXPublicKey(block.Bytes)
    if err != nil {
        return nil, err
    }

    ecdsaPub, ok := pub.(*ecdsa.PublicKey)
    if !ok {
        return nil, err
    }

    return ecdsaPub, nil
}

const express = require('express');
const crypto = require('crypto');

const app = express();

// Configure Express to get raw body for verification
app.use(express.json({
    verify: (req, res, buf) => {
        // Store raw body for signature verification
        req.rawBody = buf;
    }
}));

// The public key used for verification
const publicKeyPEM = `-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWZrLPi5uAvrLKQ5mgWLXICH3bkk2
oXl2WZLGwKysLdYPdsyc7Dc3UOPPFPdQH5Mjp24kDjiCVztCeNYc/PqR7Q==
-----END PUBLIC KEY-----`;

function verifySignature(message, signatureHex) {
    try {
        // Convert hex signature to buffer
        const signature = Buffer.from(signatureHex, 'hex');
        
        // Signature should be exactly 64 bytes (r and s are 32 bytes each)
        if (signature.length !== 64) {
            throw new Error('Invalid signature length');
        }

        // Split signature into r and s components
        const r = signature.slice(0, 32);
        const s = signature.slice(32);

        // Create verifier
        const verifier = crypto.createVerify('SHA256');
        verifier.update(message);

        // Convert raw signature to DER format
        const derSignature = {
            r: new crypto.BN(r),
            s: new crypto.BN(s)
        };

        // Verify the signature
        return verifier.verify({
            key: publicKeyPEM,
            dsaEncoding: 'ieee-p1363' // Use raw format for signature
        }, Buffer.concat([r, s]));
    } catch (error) {
        console.error('Signature verification error:', error);
        return false;
    }
}

app.post('/webhook', (req, res) => {
    try {
        // Get signature from header
        const signature = req.headers['x-signature'];
        if (!signature) {
            console.log('Missing signature header');
            return res.status(400).json({ error: 'Missing signature' });
        }

        // Verify signature using raw body
        const isValid = verifySignature(req.rawBody, signature);
        
        if (!isValid) {
            console.log('Invalid signature for payload:', req.body);
            return res.status(401).json({ error: 'Invalid signature' });
        }

        // Log the valid webhook
        console.log('Received valid webhook:', req.body);
        
        // Send success response
        res.status(200).json({ status: 'success' });
    } catch (error) {
        console.error('Webhook processing error:', error);
        res.status(500).json({ error: 'Internal server error' });
    }
});

// Add basic error handling
app.use((err, req, res, next) => {
    console.error('Unhandled error:', err);
    res.status(500).json({ error: 'Internal server error' });
});

// Start the server
const PORT = process.env.PORT || 8080;
app.listen(PORT, () => {
    console.log(`Server is running on port ${PORT}`);
});