Webhooks

import { createClient } from "@duraton/sdk/client";

const client = createClient({
  url: "https://<slug>.<project-domain>/workflows/v1",
  apiKey: process.env.DURATON_SECRET_KEY ?? "",
});

const endpoint = await client.webhooks.endpoints.create(
  {
    url: "https://example.com/hooks/duraton",
    eventTypes: ["workflows/run.failed", "database/database.paused"],
  },
  { idempotencyKey: "create-orders-hook" },
);

const TOLERANCE_SECONDS = 5 * 60;

function bytesOf(base64: string): Uint8Array | null {
  try {
    return Uint8Array.from(atob(base64), (char) => char.charCodeAt(0));
  } catch {
    return null;
  }
}

export async function verifyWebhook(
  secret: string,
  headers: Headers,
  body: string,
  nowMs: number = Date.now(),
): Promise<boolean> {
  const id = headers.get("webhook-id");
  const timestamp = headers.get("webhook-timestamp");
  const signatures = headers.get("webhook-signature");
  if (id === null || timestamp === null || signatures === null) return false;
  const ageSeconds = Math.abs(nowMs / 1000 - Number(timestamp));
  if (!(ageSeconds <= TOLERANCE_SECONDS)) return false;
  const key = bytesOf(secret.replace(/^whsec_/, ""));
  if (key === null) return false;
  const hmac = await crypto.subtle.importKey(
    "raw",
    key,
    { name: "HMAC", hash: "SHA-256" },
    false,
    ["verify"],
  );
  const signed = new TextEncoder().encode(`${id}.${timestamp}.${body}`);
  for (const entry of signatures.split(" ")) {
    const [version, signature = ""] = entry.split(",");
    const bytes = bytesOf(signature);
    if (version !== "v1" || bytes === null) continue;
    if (await crypto.subtle.verify("HMAC", hmac, bytes, signed)) return true;
  }
  return false;
}

import { defineWorkflow } from "@duraton/sdk";

const BILLING_ENDPOINT = "<endpoint-id>";

export const orderPaid = defineWorkflow<{ orderId: string; total: number }>({
  name: "order-paid",
  triggers: [{ event: "shop/order.paid" }],
  handler: async ({ event, webhook }) => {
    await webhook.send("notify-billing", {
      endpointId: BILLING_ENDPOINT,
      type: "order.paid",
      data: { orderId: event.data.orderId, total: event.data.total },
    });
  },
});