Receive events with webhooks

import { createServer } from "node:http";
import { createHmac, timingSafeEqual } from "node:crypto";

const SECRET = process.env.KOMMIO_WEBHOOK_SECRET!;
const seen = new Set<number>(); // use your database in production

function verify(header: string | undefined, body: string): boolean {
  if (!header) return false;
  const parts = Object.fromEntries(header.split(",").map((kv) => kv.split("=") as [string, string]));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = createHmac("sha256", SECRET).update(t + "." + body).digest("hex");
  const a = Buffer.from(expected), b = Buffer.from(parts.v1 || "");
  return a.length === b.length && timingSafeEqual(a, b);
}

createServer((req, res) => {
  let body = "";
  req.on("data", (c) => (body += c));
  req.on("end", async () => {
    if (!verify(req.headers["kommio-signature"] as string, body)) { res.writeHead(401); return res.end(); }
    const event = JSON.parse(body);
    if (seen.has(event.event_id)) { res.writeHead(200); return res.end(); }
    seen.add(event.event_id);
    res.writeHead(200); res.end();            // acknowledge first
    switch (event.type) {                      // then work
      case "message.created":
        if (event.data.direction === "inbound") await notifyOrdersTeam(event.data.conversation_id);
        break;
      case "conversation.updated":
        if (event.data.reason === "resolved") await closeTicket(event.object_id);
        break;
    }
  });
}).listen(8787);

import hmac, hashlib, json, os, time
from flask import Flask, request, abort

SECRET = os.environ["KOMMIO_WEBHOOK_SECRET"].encode()
app = Flask(__name__)
seen = set()  # use your database in production

def verify(header: str, body: bytes) -> bool:
    parts = dict(kv.split("=", 1) for kv in header.split(","))
    t = int(parts.get("t", 0))
    if abs(time.time() - t) > 300:
        return False
    expected = hmac.new(SECRET, f"{t}.".encode() + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", ""))

@app.post("/hooks/kommio")
def hook():
    body = request.get_data()
    if not verify(request.headers.get("Kommio-Signature", ""), body):
        abort(401)
    event = json.loads(body)
    if event["event_id"] in seen:
        return "", 200
    seen.add(event["event_id"])
    queue.enqueue(handle, event)   # acknowledge now, work later
    return "", 200

def handle(event):
    if event["type"] == "message.created" and event["data"]["direction"] == "inbound":
        notify_orders_team(event["data"]["conversation_id"])

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"io"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)

var secret = []byte(os.Getenv("KOMMIO_WEBHOOK_SECRET"))

func verify(header string, body []byte) bool {
	var t int64
	var sig string
	for _, kv := range strings.Split(header, ",") {
		k, v, _ := strings.Cut(kv, "=")
		switch k {
		case "t":
			t, _ = strconv.ParseInt(v, 10, 64)
		case "v1":
			sig = v
		}
	}
	if t == 0 || time.Since(time.Unix(t, 0)) > 5*time.Minute {
		return false
	}
	mac := hmac.New(sha256.New, secret)
	mac.Write([]byte(strconv.FormatInt(t, 10) + "."))
	mac.Write(body)
	return hmac.Equal([]byte(hex.EncodeToString(mac.Sum(nil))), []byte(sig))
}

func main() {
	http.HandleFunc("/hooks/kommio", func(w http.ResponseWriter, r *http.Request) {
		body, _ := io.ReadAll(io.LimitReader(r.Body, 1<<20))
		if !verify(r.Header.Get("Kommio-Signature"), body) {
			w.WriteHeader(http.StatusUnauthorized)
			return
		}
		var ev struct {
			EventID int64           `json:"event_id"`
			Type    string          `json:"type"`
			Data    json.RawMessage `json:"data"`
		}
		_ = json.Unmarshal(body, &ev)
		if !markSeen(ev.EventID) { // your store; false when already processed
			w.WriteHeader(http.StatusOK)
			return
		}
		w.WriteHeader(http.StatusOK)
		go handle(ev.Type, ev.Data)
	})
	http.ListenAndServe(":8787", nil)
}

# recent deliveries with status and response code (?status=failed for the failed ones)
curl "$KOMMIO_URL/webhooks/9/deliveries" -H "Authorization: Bearer $KOMMIO_KEY"

# replay one
curl -X POST "$KOMMIO_URL/webhooks/9/deliveries/1204/replay" -H "Authorization: Bearer $KOMMIO_KEY"

# after an outage: replay every failed delivery (the oldest 100, spaced out; at most once a minute)
curl -X POST "$KOMMIO_URL/webhooks/9/deliveries/replay-failed" -H "Authorization: Bearer $KOMMIO_KEY"

# rotate the secret (returned once; the old one stops working at once)
curl -X POST "$KOMMIO_URL/webhooks/9/rotate-secret" -H "Authorization: Bearer $KOMMIO_KEY"