Вебхуки

{
  "id": "0b1c2d3e-...",
  "type": "deal.stage_changed",
  "tenantId": "...",
  "createdAt": "2026-10-18T09:30:00.000Z",
  "recipient": {},
  "message": { "title": "deal.stage_changed", "text": "deal.stage_changed", "buttons": [] },
  "data": {
    "entity": "deal",
    "entityId": "...",
    "occurredAt": "2026-10-18T09:29:58.000Z",
    "dealId": "...",
    "number": "<номер угоди>",
    "from": "won",
    "to": "paid_to_auction"
  }
}

v1 = HMAC_SHA256( secret, "<t>.<сире тіло запиту>" )  // у hex

import { createHmac, timingSafeEqual } from 'node:crypto';
import express from 'express';

const SECRETS = [process.env.IMPORTOS_WEBHOOK_SECRET!]; // під час ротації додайте попередній
const TOLERANCE_SEC = 300;

function verify(header: string | undefined, rawBody: string): boolean {
  if (!header) return false;
  const parts = header.split(',').map((p) => p.trim());
  const t = Number(parts.find((p) => p.startsWith('t='))?.slice(2));
  const signatures = parts.filter((p) => p.startsWith('v1=')).map((p) => p.slice(3));
  if (!Number.isInteger(t) || signatures.length === 0) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > TOLERANCE_SEC) return false;
  for (const secret of SECRETS) {
    const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest();
    for (const s of signatures) {
      const got = Buffer.from(s, 'hex');
      if (got.length === expected.length && timingSafeEqual(got, expected)) return true;
    }
  }
  return false;
}

const seen = new Set<string>(); // у продакшені: Redis або таблиця з TTL

const app = express();
app.post('/importos/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const raw = req.body.toString('utf8');
  if (!verify(req.header('x-signature'), raw)) return res.status(401).end();
  const event = JSON.parse(raw);
  if (seen.has(event.id)) return res.status(200).end(); // дубль: уже оброблено
  seen.add(event.id);
  // ... обробка event.type / event.data
  res.status(200).end();
});

import hashlib, hmac, time

def verify(secret: str, header: str, raw_body: bytes, tolerance: int = 300) -> bool:
    parts = dict(p.strip().split("=", 1) for p in header.split(",") if "=" in p)
    t = int(parts["t"])
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts["v1"])