Вебхуки: приём событий

POST /api/xaxumessage/events HTTP/1.1
Content-Type: application/json
User-Agent: xaxumessage/0.1
X-Xaxu-Event-Id: 1042
X-Xaxu-Event-Type: message.created
X-Xaxu-Timestamp: 1791625691
X-Xaxu-Signature: sha256=5d0c3e…

{"id":1042,"type":"message.created","createdAt":"2026-10-10T09:28:11.200Z","tenantId":"c3d4e5f6-1a2b-4c3d-8e9f-0a1b2c3d4e5f","accountId":"5b1e9c3a-8f2d-4c71-9a0e-2d6f1b7c4e10","data":{…}}

import { createHmac, timingSafeEqual } from 'node:crypto';

// rawBody — ровно те байты, что пришли (не JSON.stringify от разобранного объекта!)
export function verify(rawBody: string, headers: Headers, secret: string): boolean {
  const ts = headers.get('x-xaxu-timestamp');
  const sig = headers.get('x-xaxu-signature');
  if (!ts || !sig) return false;
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false; // старше 5 минут — отклонить

  const expected = 'sha256=' + createHmac('sha256', secret).update(`${ts}.${rawBody}`).digest('hex');
  const a = Buffer.from(expected), b = Buffer.from(sig);
  return a.length === b.length && timingSafeEqual(a, b);
}

// Next.js (App Router): app/api/xaxumessage/events/route.ts
export async function POST(req: Request) {
  const raw = await req.text();
  if (!verify(raw, req.headers, process.env.XM_WEBHOOK_SECRET!)) return new Response('bad signature', { status: 401 });
  const event = JSON.parse(raw);
  // дедупликация по event.id, затем обработка; долгую работу — в очередь
  return new Response('ok');
}

<?php
$raw = file_get_contents('php://input');
$ts  = $_SERVER['HTTP_X_XAXU_TIMESTAMP'] ?? '';
$sig = $_SERVER['HTTP_X_XAXU_SIGNATURE'] ?? '';
$expected = 'sha256=' . hash_hmac('sha256', $ts . '.' . $raw, getenv('XM_WEBHOOK_SECRET'));

if (abs(time() - (int)$ts) > 300 || !hash_equals($expected, $sig)) {
    http_response_code(401);
    exit;
}
$event = json_decode($raw, true);
// дедупликация по $event['id'], затем обработка
http_response_code(200);

import hmac, hashlib, time

def verify(raw_body: bytes, headers, secret: str) -> bool:
    ts = headers.get('X-Xaxu-Timestamp', '')
    sig = headers.get('X-Xaxu-Signature', '')
    if not ts or abs(time.time() - int(ts)) > 300:
        return False
    mac = hmac.new(secret.encode(), ts.encode() + b'.' + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest('sha256=' + mac, sig)