Webhooki

curl -s -X POST https://my.clarife.app/api/webhooks/subscriptions \
  -H "Authorization: Bearer TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Mój webhook",
    "url": "https://example.com/webhooks/clarife",
    "events": ["document.created", "document.updated", "share.created"]
  }' | jq

{
  "subscription": {
    "id": "ws1234-...",
    "name": "Mój webhook",
    "url": "https://example.com/webhooks/clarife",
    "events": ["document.created", "document.updated", "share.created"],
    "active": true,
    "failure_count": 0,
    "created_at": "2026-03-28T12:00:00Z",
    "secret": "whsec_a1b2c3d4e5f6..."
  }
}

{
  "id": "evt_a1b2c3d4-...",
  "event": "document.created",
  "created_at": "2026-03-28T12:00:00Z",
  "data": {
    "title": "Nowy tutorial"
  }
}

X-Clarife-Signature: t=1711612800,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8f9

import crypto from "node:crypto";

function verifyWebhookSignature(rawBody, signature, deliveryId, secret) {
  const [tPart, v1Part] = signature.split(",");
  const timestamp = tPart.replace("t=", "");
  const expectedSig = v1Part.replace("v1=", "");

  // Ochrona przed atakami replay (5 minut)
  const age = Math.abs(Date.now() / 1000 - parseInt(timestamp));
  if (age > 300) {
    throw new Error("Webhook timestamp too old");
  }

  const computed = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${deliveryId}.${rawBody}`)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(computed),
    Buffer.from(expectedSig)
  );
}

curl -s -X POST https://my.clarife.app/api/webhooks/subscriptions/SUBSCRIPTION_ID/test \
  -H "Authorization: Bearer TOKEN" | jq