import 'dotenv/config';
import crypto from 'crypto';

interface WebhookResponse {
  id: string;
  url: string;
  created_at: string;
}

async function createWebhook(url: string, secret: string): Promise<WebhookResponse> {
  const response = await fetch('https://vertaaux.ai/api/v1/webhooks', {
    method: 'POST',
    headers: {
      'X-API-Key': process.env.VERTAAUX_API_KEY!,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ url, secret }),
  });

  if (!response.ok) {
    const error = await response.json();
    throw new Error(`Failed to create webhook: ${error.message}`);
  }

  return response.json();
}

// Generate a secure secret
const secret = crypto.randomBytes(32).toString('hex');

// Usage
const webhook = await createWebhook('https://example.com/webhooks/vertaa', secret);
console.log(`Webhook created: ${webhook.id}`);
// Store the secret securely for signature verification

# Generate a secure secret
SECRET=$(openssl rand -hex 32)
echo "Store this secret: $SECRET"

# Create webhook
curl -X POST https://vertaaux.ai/api/v1/webhooks \
  -H "X-API-Key: $VERTAAUX_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
    \"url\": \"https://example.com/webhooks/vertaa\",
    \"secret\": \"$SECRET\"
  }"

import os
import secrets
import requests
from typing import TypedDict

class WebhookResponse(TypedDict):
    id: str
    url: str
    created_at: str

def create_webhook(url: str, secret: str) -> WebhookResponse:
    """Create a new webhook."""
    response = requests.post(
        'https://vertaaux.ai/api/v1/webhooks',
        headers={
            'X-API-Key': os.environ['VERTAAUX_API_KEY'],
            'Content-Type': 'application/json',
        },
        json={'url': url, 'secret': secret}
    )

    if not response.ok:
        error = response.json()
        raise Exception(f"Failed to create webhook: {error.get('message')}")

    return response.json()

# Generate a secure secret
secret = secrets.token_hex(32)
print(f"Store this secret: {secret}")

# Usage
webhook = create_webhook('https://example.com/webhooks/vertaa', secret)
print(f"Webhook created: {webhook['id']}")

import crypto from 'crypto';

const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET!;
const TOLERANCE_SECONDS = 300; // 5 minutes

interface VerificationResult {
  valid: boolean;
  error?: string;
}

function verifyWebhookSignature(
  payload: string,
  signature: string
): VerificationResult {
  // Parse signature header
  const parts = signature.split(',');
  const timestamp = parts.find(p => p.startsWith('t='))?.slice(2);
  const sig = parts.find(p => p.startsWith('v1='))?.slice(3);

  if (!timestamp || !sig) {
    return { valid: false, error: 'Invalid signature format' };
  }

  // Check timestamp (replay attack protection)
  const signedAt = parseInt(timestamp, 10);
  const now = Math.floor(Date.now() / 1000);

  if (Math.abs(now - signedAt) > TOLERANCE_SECONDS) {
    return { valid: false, error: 'Signature expired' };
  }

  // Compute expected signature
  const signedPayload = `${timestamp}.${payload}`;
  const expected = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(signedPayload)
    .digest('hex');

  // Timing-safe comparison
  const sigBuffer = Buffer.from(sig, 'hex');
  const expectedBuffer = Buffer.from(expected, 'hex');

  if (sigBuffer.length !== expectedBuffer.length) {
    return { valid: false, error: 'Signature mismatch' };
  }

  if (!crypto.timingSafeEqual(sigBuffer, expectedBuffer)) {
    return { valid: false, error: 'Signature mismatch' };
  }

  return { valid: true };
}

// Express.js example
import express from 'express';

const app = express();
app.use(express.raw({ type: 'application/json' }));

app.post('/webhooks/vertaa', (req, res) => {
  const signature = req.headers['x-vertaa-signature'] as string;
  const payload = req.body.toString();

  const { valid, error } = verifyWebhookSignature(payload, signature);

  if (!valid) {
    console.error('Webhook verification failed:', error);
    return res.status(401).json({ error });
  }

  const event = JSON.parse(payload);
  console.log(`Received ${event.event} for job ${event.data.job_id}`);

  // Process the event...

  res.status(200).json({ received: true });
});

import os
import hmac
import hashlib
import time
from typing import Tuple

WEBHOOK_SECRET = os.environ['WEBHOOK_SECRET']
TOLERANCE_SECONDS = 300  # 5 minutes

def verify_webhook_signature(
    payload: str,
    signature: str
) -> Tuple[bool, str | None]:
    """Verify webhook signature.

    Returns:
        (valid, error_message)
    """
    # Parse signature header
    parts = dict(p.split('=', 1) for p in signature.split(',') if '=' in p)
    timestamp = parts.get('t')
    sig = parts.get('v1')

    if not timestamp or not sig:
        return False, 'Invalid signature format'

    # Check timestamp (replay attack protection)
    signed_at = int(timestamp)
    now = int(time.time())

    if abs(now - signed_at) > TOLERANCE_SECONDS:
        return False, 'Signature expired'

    # Compute expected signature
    signed_payload = f'{timestamp}.{payload}'
    expected = hmac.new(
        WEBHOOK_SECRET.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()

    # Timing-safe comparison
    if not hmac.compare_digest(sig, expected):
        return False, 'Signature mismatch'

    return True, None

# Flask example
from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/webhooks/vertaa', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Vertaa-Signature', '')
    payload = request.get_data(as_text=True)

    valid, error = verify_webhook_signature(payload, signature)

    if not valid:
        print(f'Webhook verification failed: {error}')
        return jsonify({'error': error}), 401

    event = request.get_json()
    print(f"Received {event['event']} for job {event['data']['job_id']}")

    # Process the event...

    return jsonify({'received': True})