Webhooks

import hmac, hashlib

def verify(body_bytes: bytes, signature_header: str, secret: str) -> bool:
    """Constant-time HMAC verification against the X-Decimal-Signature header."""
    expected = "sha256=" + hmac.new(
        secret.encode(), body_bytes, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature_header)

# In your webhook handler — hash the RAW body, not the re-serialized JSON:
raw = await request.body()
sig = request.headers.get("X-Decimal-Signature", "")
if not verify(raw, sig, os.environ["DECIMAL_WEBHOOK_SECRET"]):
    return Response(status_code=401)

import crypto from "crypto";

function verify(bodyBytes, signatureHeader, secret) {
  // Constant-time HMAC verification against the X-Decimal-Signature header.
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(bodyBytes).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signatureHeader || "");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// In your webhook handler — hash the RAW body, not the re-serialized JSON.
// Use express.raw() so req.body is the original bytes:
const sig = req.headers["x-decimal-signature"] || "";
if (!verify(req.body, sig, process.env.DECIMAL_WEBHOOK_SECRET)) {
  return res.status(401).end();
}

import json, os
from fastapi import FastAPI, Request, Response

app = FastAPI()

@app.post("/decimalai/hook")
async def handle_webhook(request: Request):
    # Verify before trusting anything in the payload — verify() is defined above.
    raw = await request.body()
    sig = request.headers.get("X-Decimal-Signature", "")
    if not verify(raw, sig, os.environ["DECIMAL_WEBHOOK_SECRET"]):
        return Response(status_code=401)

    body = json.loads(raw)
    event = body["event"]
    data = body["data"]

    if event == "regression.detected":
        # Alert your team — Slack, PagerDuty, email
        notify_slack(
            f"[ALERT] Regression on {data['agent_name']} {data['version_label']} "
            f"({data['metric']} dropped {data['delta']:+.2f})"
        )

    return {"received": True}

import express from "express";
const app = express();
// Raw bytes, not express.json() — the signature covers the bytes as sent.
app.use(express.raw({ type: "application/json" }));

app.post("/decimalai/hook", (req, res) => {
  // Verify before trusting anything in the payload — verify() is defined above.
  const sig = req.headers["x-decimal-signature"] || "";
  if (!verify(req.body, sig, process.env.DECIMAL_WEBHOOK_SECRET)) {
    return res.status(401).end();
  }

  const { event, data } = JSON.parse(req.body);

  if (event === "regression.detected") {
    notifySlack(
      `[ALERT] Regression on ${data.agent_name} ${data.version_label} ` +
      `(${data.metric} dropped ${data.delta.toFixed(2)})`
    );
  }

  res.json({ received: true });
});