Webhooks and Slack

import crypto from "node:crypto";
import express from "express";

const JWKS_URL = "https://odyssey.asteroid.ai/.well-known/jwks.json";

let keysByKid = new Map();

async function publicKeyFor(kid) {
  if (!keysByKid.has(kid)) {
    const response = await fetch(JWKS_URL);
    if (!response.ok) {
      throw new Error(`JWKS fetch failed: ${response.status}`);
    }
    const { keys } = await response.json();
    keysByKid = new Map(
      keys.map((jwk) => [jwk.kid, crypto.createPublicKey({ key: jwk, format: "jwk" })]),
    );
  }
  return keysByKid.get(kid);
}

const app = express();

app.post("/webhook", express.raw({ type: "application/json" }), async (req, res) => {
  try {
    const kid = req.header("X-Asteroid-Webhook-Key-Id");
    const signature = req.header("X-Asteroid-Webhook-Signature");
    if (!kid || !signature) {
      return res.status(401).json({ error: "Missing signature" });
    }

    const publicKey = await publicKeyFor(kid);
    if (!publicKey) {
      return res.status(401).json({ error: "Unknown signing key" });
    }

    const verifier = crypto.createVerify("sha256");
    verifier.update(req.body);
    verifier.end();
    if (!verifier.verify(publicKey, signature, "base64")) {
      return res.status(401).json({ error: "Invalid signature" });
    }

    const event = JSON.parse(req.body.toString("utf8"));
    console.log(event.info.event, event.info.execution_id ?? event.info.batch_id);

    res.status(200).json({ received: true });
  } catch {
    res.status(500).json({ error: "Verification failed" });
  }
});

app.listen(3000);

import base64

import requests
from cryptography.exceptions import InvalidSignature
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding, rsa
from flask import Flask, request

JWKS_URL = "https://odyssey.asteroid.ai/.well-known/jwks.json"

keys_by_kid = {}


def public_key_for(kid):
    if kid not in keys_by_kid:
        jwks = requests.get(JWKS_URL, timeout=10).json()
        keys_by_kid.clear()
        keys_by_kid.update({jwk["kid"]: to_public_key(jwk) for jwk in jwks["keys"]})
    return keys_by_kid.get(kid)


def to_public_key(jwk):
    def decode(value):
        padded = value + "=" * (-len(value) % 4)
        return int.from_bytes(base64.urlsafe_b64decode(padded), "big")

    return rsa.RSAPublicNumbers(decode(jwk["e"]), decode(jwk["n"])).public_key()


app = Flask(__name__)


@app.post("/webhook")
def webhook():
    kid = request.headers.get("X-Asteroid-Webhook-Key-Id")
    signature = request.headers.get("X-Asteroid-Webhook-Signature")
    if not kid or not signature:
        return {"error": "Missing signature"}, 401

    public_key = public_key_for(kid)
    if public_key is None:
        return {"error": "Unknown signing key"}, 401

    try:
        public_key.verify(
            base64.b64decode(signature),
            request.get_data(),
            padding.PKCS1v15(),
            hashes.SHA256(),
        )
    except InvalidSignature:
        return {"error": "Invalid signature"}, 401

    event = request.get_json()
    info = event["info"]
    print(info["event"], info.get("execution_id") or info.get("batch_id"))

    return {"received": True}, 200