Webhooks

import hashlib
import hmac
import time

from flask import Flask, abort, request

app = Flask(__name__)
SIGNING_SECRET = b"YOUR_SIGNING_SECRET"
seen_deliveries = set()  # use a persistent store in production

@app.post("/hooks/vidnavigator")
def vidnavigator_webhook():
    header = request.headers.get("X-VidNavigator-Signature", "")
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    t, v1 = parts.get("t"), parts.get("v1")
    if not t or not v1 or abs(time.time() - int(t)) > 300:
        abort(400)

    raw_body = request.get_data()
    expected = hmac.new(SIGNING_SECRET, f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, v1):
        abort(401)

    delivery_id = request.headers["X-VidNavigator-Delivery"]
    if delivery_id in seen_deliveries:
        return "", 200  # already processed
    seen_deliveries.add(delivery_id)

    event = request.get_json()
    if event["data"]["task_status"] == "completed":
        ...  # use event["data"]["result"], or fetch check_status_url if result_truncated
    else:
        ...  # event["data"]["error"]
    return "", 200

const crypto = require('crypto');
const express = require('express');

const app = express();
const SIGNING_SECRET = 'YOUR_SIGNING_SECRET';
const seenDeliveries = new Set(); // use a persistent store in production

app.post('/hooks/vidnavigator', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('X-VidNavigator-Signature') || '';
  const parts = Object.fromEntries(header.split(',').map(p => p.split('=')));
  const { t, v1 } = parts;
  if (!t || !v1 || Math.abs(Date.now() / 1000 - Number(t)) > 300) return res.sendStatus(400);

  const expected = crypto
    .createHmac('sha256', SIGNING_SECRET)
    .update(`${t}.`)
    .update(req.body) // raw Buffer
    .digest('hex');
  if (expected.length !== v1.length ||
      !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1))) {
    return res.sendStatus(401);
  }

  const deliveryId = req.get('X-VidNavigator-Delivery');
  if (seenDeliveries.has(deliveryId)) return res.sendStatus(200);
  seenDeliveries.add(deliveryId);

  const event = JSON.parse(req.body);
  // event.data.result, or fetch event.data.check_status_url if result_truncated
  res.sendStatus(200);
});