Webhooks: close the loop

const endpoint = await hive.webhooks.create({
  url: 'https://api.acme.example/hive/webhook',
  events: ['run.completed', 'run.failed', 'approval.requested'],
  description: 'orders service',
});
// endpoint.secret is shown ONCE → store it as HIVE_WEBHOOK_SECRET

curl -X POST https://console.agenticworkforce.me/v1/webhooks \
  -H "Authorization: Bearer $HIVE_API_KEY" -H "X-Tenant-Id: $HIVE_TENANT_ID" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://api.acme.example/hive/webhook",
       "events":["run.completed","run.failed","approval.requested"]}'
# → 201 { "id": "…", "url": "…", "events": […], "enabled": true, "secret": "…shown once…" }

# Send a signed webhook.test right away
curl -X POST https://console.agenticworkforce.me/v1/webhooks/$ENDPOINT_ID/test \
  -H "Authorization: Bearer $HIVE_API_KEY" -H "X-Tenant-Id: $HIVE_TENANT_ID"

import express from 'express';
import { verifyWebhookSignature } from '@hive/sdk'; // or copy hive-signing.mjs from the example

const app = express();

// Raw body FIRST — the signature covers the exact bytes the platform sent.
app.post('/hive/webhook', express.raw({ type: '*/*' }), async (req, res) => {
  const raw = req.body.toString('utf8');
  const check = verifyWebhookSignature(process.env.HIVE_WEBHOOK_SECRET!, req.get('hive-signature') ?? '', raw);
  if (!check.ok) return res.status(401).json({ error: check.reason }); // MALFORMED_HEADER | STALE_TIMESTAMP | SIGNATURE_MISMATCH

  const event = JSON.parse(raw) as { id: string; type: string; data: Record<string, unknown> };
  if (await alreadyProcessed(event.id)) return res.status(200).json({ duplicate: true }); // retries resend the same id

  await enqueue(event); // ACK fast, apply asynchronously
  res.status(200).json({ received: true });
});

from __future__ import annotations

import hashlib
import hmac
import re
import time

_HEADER = re.compile(r"^t=(\d+),v1=([0-9a-f]{64})$")


def verify_hive_webhook(secret: str, signature_header: str, raw_body: bytes,
                        tolerance_sec: int = 300, now: int | None = None) -> bool:
    """Hive-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, "<t>.<raw body>")>."""
    match = _HEADER.match((signature_header or "").strip())
    if match is None:
        return False
    ts, provided = int(match.group(1)), match.group(2)
    if abs((now if now is not None else int(time.time())) - ts) > tolerance_sec:
        return False  # replay window
    expected = hmac.new(secret.encode("utf-8"), f"{ts}.".encode("utf-8") + raw_body,
                        hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected.encode("ascii"), provided.encode("ascii"))


if __name__ == "__main__":
    # Flask: request.get_data() is the RAW body — never re-serialize request.json.
    import json
    import os

    from flask import Flask, request

    app = Flask(__name__)
    seen: set[str] = set()

    @app.post("/hive/webhook")
    def hive_webhook():
        raw = request.get_data()
        if not verify_hive_webhook(os.environ["HIVE_WEBHOOK_SECRET"],
                                   request.headers.get("Hive-Signature", ""), raw):
            return {"error": "INVALID_SIGNATURE"}, 401
        event = json.loads(raw)
        if event["id"] in seen:            # retries resend the same id
            return {"duplicate": True}, 200
        seen.add(event["id"])
        handle(event)                      # enqueue in production; ACK fast
        return {"received": True}, 200

using System.Linq;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Text.RegularExpressions;

static bool VerifyHiveWebhook(string secret, string signatureHeader, byte[] rawBody, int toleranceSec = 300)
{
    var m = Regex.Match(signatureHeader?.Trim() ?? "", @"^t=(\d+),v1=([0-9a-f]{64})$");
    if (!m.Success) return false;
    long ts = long.Parse(m.Groups[1].Value);
    if (Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - ts) > toleranceSec) return false; // replay window
    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
    byte[] signed = Encoding.UTF8.GetBytes(ts + ".").Concat(rawBody).ToArray();      // "<t>.<raw body>"
    string expected = Convert.ToHexString(hmac.ComputeHash(signed)).ToLowerInvariant(); // v1 is lowercase hex; ToHexString is uppercase
    return CryptographicOperations.FixedTimeEquals(Encoding.UTF8.GetBytes(expected),
                                                   Encoding.UTF8.GetBytes(m.Groups[2].Value));
}

// ASP.NET Core minimal API — read the raw body, verify, de-duplicate on the envelope id
app.MapPost("/hive/webhook", async (HttpRequest req) =>
{
    using var ms = new MemoryStream();
    await req.Body.CopyToAsync(ms);
    byte[] raw = ms.ToArray();
    if (!VerifyHiveWebhook(Environment.GetEnvironmentVariable("HIVE_WEBHOOK_SECRET")!,
                           req.Headers["Hive-Signature"].ToString(), raw))
        return Results.Unauthorized();
    var evt = JsonDocument.Parse(raw).RootElement;      // evt["id"], evt["type"], evt["data"]
    return Results.Ok(new { received = true });
});

// Java 17+ (HexFormat)
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.HexFormat;
import java.util.regex.*;

static boolean verifyHiveWebhook(String secret, String signatureHeader, byte[] rawBody) throws Exception {
    long toleranceSec = 300;
    Matcher m = Pattern.compile("^t=(\\d+),v1=([0-9a-f]{64})$").matcher(signatureHeader == null ? "" : signatureHeader.trim());
    if (!m.matches()) return false;
    long ts = Long.parseLong(m.group(1));
    if (Math.abs(System.currentTimeMillis() / 1000 - ts) > toleranceSec) return false;   // replay window (300 s)
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
    mac.update((ts + ".").getBytes(StandardCharsets.UTF_8));                             // "<t>.<raw body>"
    mac.update(rawBody);
    String expected = HexFormat.of().formatHex(mac.doFinal());
    return MessageDigest.isEqual(expected.getBytes(StandardCharsets.UTF_8), m.group(2).getBytes(StandardCharsets.UTF_8));
}

// Spring: @PostMapping("/hive/webhook") with @RequestBody byte[] rawBody and
// @RequestHeader("Hive-Signature") String sig → verify, then de-duplicate on the JSON "id".