EXPERIMENTAL! Outgoing Webhooks

{
  "event": "entry.created",
  "timestamp": "2024-01-15T10:30:00.000Z",
  "helper": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "name": "Expense Tracker",
    "command": "/expense"
  },
  "entry": {
    "id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "data": {
      "amount": 42.50,
      "category": "Food",
      "description": "Lunch meeting",
      "date": "2024-01-15"
    },
    "created_at": "2024-01-15T10:30:00.000Z"
  }
}

POST /your-webhook-endpoint HTTP/1.1
Content-Type: application/json
User-Agent: Peanuts-Webhook/1.0
X-Peanuts-Signature: sha256=abc123... (if signing secret is configured)

openssl rand -hex 32

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(payload))
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// In your webhook handler:
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-peanuts-signature'];
  const isValid = verifyWebhookSignature(req.body, signature, YOUR_SECRET);

  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }

  // Process the webhook...
  res.status(200).send('OK');
});

import hmac
import hashlib
import json

def verify_webhook_signature(payload, signature, secret):
    expected = 'sha256=' + hmac.new(
        secret.encode(),
        json.dumps(payload).encode(),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(signature, expected)

# In your webhook handler:
@app.route('/webhook', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Peanuts-Signature')
    is_valid = verify_webhook_signature(
        request.json, 
        signature, 
        YOUR_SECRET
    )

    if not is_valid:
        return 'Invalid signature', 401

    # Process the webhook...
    return 'OK', 200

function verifyWebhookSignature($payload, $signature, $secret) {
    $expected = 'sha256=' . hash_hmac(
        'sha256', 
        json_encode($payload), 
        $secret
    );

    return hash_equals($signature, $expected);
}

// In your webhook handler:
$signature = $_SERVER['HTTP_X_PEANUTS_SIGNATURE'] ?? '';
$payload = json_decode(file_get_contents('php://input'), true);

if (!verifyWebhookSignature($payload, $signature, YOUR_SECRET)) {
    http_response_code(401);
    exit('Invalid signature');
}

// Process the webhook...
http_response_code(200);
echo 'OK';

function doPost(e) {
  const sheet = SpreadsheetApp.getActiveSpreadsheet().getActiveSheet();
  const data = JSON.parse(e.postData.contents);

  sheet.appendRow([
    data.timestamp,
    data.helper.name,
    JSON.stringify(data.entry.data)
  ]);

  return ContentService.createTextOutput('OK');
}