Real-time event notifications.

import hashlib
import hmac

def verify_sepurux_signature(
    raw_body: bytes,
    secret: str,
    signature_header: str,
) -> bool:
    """Return True if the X-Sepurux-Signature header matches the payload."""
    expected = "sha256=" + hmac.new(
        secret.encode("utf-8"),
        raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, signature_header)


# In a FastAPI handler:
from fastapi import Request, HTTPException

@app.post("/hooks/sepurux")
async def handle_webhook(request: Request):
    body = await request.body()
    sig = request.headers.get("X-Sepurux-Signature", "")
    if not verify_sepurux_signature(body, WEBHOOK_SECRET, sig):
        raise HTTPException(status_code=401, detail="Invalid signature")
    event = await request.json()
    print(event["event_type"], event["data"])
    return {"ok": True}

import crypto from "crypto";

function verifySepuruxSignature(
  rawBody: Buffer,
  secret: string,
  signatureHeader: string,
): boolean {
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader),
  );
}

// In an Express handler:
app.post(
  "/hooks/sepurux",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const sig = req.headers["x-sepurux-signature"] as string;
    if (!verifySepuruxSignature(req.body, WEBHOOK_SECRET, sig)) {
      return res.status(401).json({ error: "Invalid signature" });
    }
    const event = JSON.parse(req.body.toString());
    console.log(event.event_type, event.data);
    res.json({ ok: true });
  },
);