Receiving call outcomes

import crypto from "node:crypto";
import express from "express";

const app = express();
const WEBHOOK_SECRET = process.env.GROWDENTAL_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 300;

/**
 * Verify an X-GrowDental-Signature header against the raw request body.
 * Format: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, `${t}.${rawBody}`)>
 */
function verifyGrowDentalSignature(rawBody, signatureHeader, secret) {
  if (!signatureHeader || typeof signatureHeader !== "string") return false;

  const parts = {};
  for (const piece of signatureHeader.split(",")) {
    const idx = piece.indexOf("=");
    if (idx > 0) parts[piece.slice(0, idx).trim()] = piece.slice(idx + 1).trim();
  }

  const timestamp = Number.parseInt(parts.t ?? "", 10);
  const expected = parts.v1 ?? "";
  if (!Number.isFinite(timestamp) || !/^[0-9a-f]{64}$/.test(expected)) return false;

  // Replay protection: reject stale or future-dated deliveries.
  const nowSeconds = Math.floor(Date.now() / 1000);
  if (Math.abs(nowSeconds - timestamp) > TOLERANCE_SECONDS) return false;

  const computed = crypto
    .createHmac("sha256", secret)
    .update(`${parts.t}.`)
    .update(rawBody) // Buffer of the raw request bytes
    .digest("hex");

  // Constant-time comparison.
  const a = Buffer.from(computed, "hex");
  const b = Buffer.from(expected, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// express.raw() keeps req.body as a Buffer for this route only.
app.post(
  "/growdental/webhooks",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.header("X-GrowDental-Signature");
    if (!verifyGrowDentalSignature(req.body, signature, WEBHOOK_SECRET)) {
      return res.status(401).send("invalid signature");
    }

    const deliveryId = req.header("X-GrowDental-Delivery-Id");
    // TODO: skip if deliveryId was already processed (at-least-once delivery).

    const event = JSON.parse(req.body.toString("utf8"));
    switch (event.type) {
      case "call.completed":
        console.log(`Call ${event.data.call_id} -> ${event.data.outcome}`);
        break;
      case "call.recording.ready":
        console.log(`Recording ready for call ${event.data.call_id}`);
        break;
      case "call_request.completed":
        console.log(`Call request ${event.data.call_request_id} finished`);
        break;
    }

    // Acknowledge fast; do real work on a queue.
    res.status(204).end();
  }
);

app.listen(3000);

import hashlib
import hmac
import json
import os
import re
import time

from flask import Flask, request

app = Flask(__name__)
WEBHOOK_SECRET = os.environ["GROWDENTAL_WEBHOOK_SECRET"]
TOLERANCE_SECONDS = 300
_HEX64 = re.compile(r"^[0-9a-f]{64}$")


def verify_growdental_signature(raw_body: bytes, signature_header: str, secret: str) -> bool:
    """Verify an X-GrowDental-Signature header against the raw request body.

    Format: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, f"{t}.{raw_body}")>
    """
    if not signature_header:
        return False

    parts = {}
    for piece in signature_header.split(","):
        key, sep, value = piece.partition("=")
        if sep:
            parts[key.strip()] = value.strip()

    timestamp_str = parts.get("t", "")
    expected = parts.get("v1", "")
    if not timestamp_str.isdigit() or not _HEX64.match(expected):
        return False

    # Replay protection: reject stale or future-dated deliveries.
    if abs(time.time() - int(timestamp_str)) > TOLERANCE_SECONDS:
        return False

    signed_payload = timestamp_str.encode("ascii") + b"." + raw_body
    computed = hmac.new(secret.encode("utf-8"), signed_payload, hashlib.sha256).hexdigest()

    # Constant-time comparison.
    return hmac.compare_digest(computed, expected)


@app.post("/growdental/webhooks")
def growdental_webhook():
    raw_body = request.get_data()  # raw bytes, before any JSON parsing
    signature = request.headers.get("X-GrowDental-Signature", "")

    if not verify_growdental_signature(raw_body, signature, WEBHOOK_SECRET):
        return "invalid signature", 401

    delivery_id = request.headers.get("X-GrowDental-Delivery-Id")
    # TODO: skip if delivery_id was already processed (at-least-once delivery).

    event = json.loads(raw_body)
    if event["type"] == "call.completed":
        print(f"Call {event['data']['call_id']} -> {event['data']['outcome']}")
    elif event["type"] == "call.recording.ready":
        print(f"Recording ready for call {event['data']['call_id']}")
    elif event["type"] == "call_request.completed":
        print(f"Call request {event['data']['call_request_id']} finished")

    # Acknowledge fast; do real work on a queue.
    return "", 204