import crypto from "crypto";

function sign(rawBody: string, secret: string): string {
  return crypto.createHmac("sha256", secret).update(rawBody, "utf8").digest("hex");
}

const body = JSON.stringify(payload);
const signature = sign(body, process.env.WEBHOOK_SECRET!);

await fetch("https://hub.simplafy.com.br/api/v1/webhooks/ORG_ID/followize", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-Webhook-Signature": `sha256=${signature}`,
  },
  body,
});

import hmac
import hashlib
import json
import requests

def sign(raw_body: str, secret: str) -> str:
    return hmac.new(
        secret.encode("utf-8"),
        raw_body.encode("utf-8"),
        hashlib.sha256,
    ).hexdigest()

body = json.dumps(payload)
signature = sign(body, WEBHOOK_SECRET)

requests.post(
    "https://hub.simplafy.com.br/api/v1/webhooks/ORG_ID/followize",
    headers={
        "Content-Type": "application/json",
        "X-Webhook-Signature": f"sha256={signature}",
    },
    data=body,
)

BODY='{"id":"lead-abc","contact":{"phone":"5511999998888"}}'
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" -hex | sed 's/^.* //')

curl -X POST https://hub.simplafy.com.br/api/v1/webhooks/ORG_ID/followize \
  -H "Content-Type: application/json" \
  -H "X-Webhook-Signature: sha256=$SIG" \
  -d "$BODY"

import express from "express";
import crypto from "crypto";

const app = express();
const SECRET = process.env.WEBHOOK_SECRET!;

// IMPORTANTE: usar raw body, não express.json()
app.post(
  "/webhooks/hub",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const rawBody = req.body.toString("utf8");
    const header = req.header("x-webhook-signature") ?? "";
    const received = header.replace(/^sha256=/i, "").toLowerCase();

    const expected = crypto
      .createHmac("sha256", SECRET)
      .update(rawBody, "utf8")
      .digest("hex");

    const a = Buffer.from(expected, "hex");
    const b = Buffer.from(received, "hex");

    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.status(401).json({ error: "Invalid signature" });
    }

    const event = JSON.parse(rawBody);

    // Processar em background, responder rápido
    queueMicrotask(() => handleEvent(event));

    return res.status(200).json({ received: true });
  },
);

import hmac
import hashlib
import os
from fastapi import FastAPI, Header, HTTPException, Request, BackgroundTasks

app = FastAPI()
SECRET = os.environ["WEBHOOK_SECRET"]

@app.post("/webhooks/hub")
async def receive(
    request: Request,
    background_tasks: BackgroundTasks,
    x_webhook_signature: str | None = Header(default=None),
):
    raw_body = await request.body()
    header = (x_webhook_signature or "").lower()
    received = header[len("sha256="):] if header.startswith("sha256=") else header

    expected = hmac.new(
        SECRET.encode("utf-8"), raw_body, hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected, received):
        raise HTTPException(status_code=401, detail="Invalid signature")

    event = await request.json()
    background_tasks.add_task(handle_event, event)
    return {"received": True}