Webhooks

POST /hubfit-webhooks HTTP/1.1
Host: example.com
Content-Type: application/json
User-Agent: HubFit-Webhooks/1
webhook-id: evt_6ad6af72e7830e73e784a170
webhook-timestamp: 1792333926
webhook-signature: v1,6Sg6WEvSdqSIg3H1VxyItzl+JuUMgoUl9uAPe1sSTlk=

import crypto from "node:crypto";

// Pass the raw body: JSON parsed and serialised again won't match the signature.
export function verifyHubFitWebhook(rawBody, headers, secret) {
  const id = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];

  // Refuse requests more than 5 minutes old, to block replays.
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;

  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = crypto
    .createHmac("sha256", key)
    .update(`${id}.${timestamp}.${rawBody}`)
    .digest();

  // One signature today, but the header can hold several, space-separated.
  return (headers["webhook-signature"] ?? "").split(" ").some((entry) => {
    const [version, signature] = entry.split(",");
    const given = Buffer.from(signature ?? "", "base64");
    return version === "v1" && given.length === expected.length && crypto.timingSafeEqual(given, expected);
  });
}

import base64
import hashlib
import hmac
import time

# Pass the raw body: JSON parsed and serialised again won't match the signature.
def verify_hubfit_webhook(raw_body: bytes, headers, secret: str) -> bool:
    msg_id = headers["webhook-id"]
    timestamp = headers["webhook-timestamp"]

    # Refuse requests more than 5 minutes old, to block replays.
    if abs(time.time() - int(timestamp)) > 300:
        return False

    key = base64.b64decode(secret.removeprefix("whsec_"))
    signed = f"{msg_id}.{timestamp}.".encode() + raw_body
    expected = base64.b64encode(hmac.new(key, signed, hashlib.sha256).digest()).decode()

    # One signature today, but the header can hold several, space-separated.
    for entry in headers.get("webhook-signature", "").split(" "):
        version, _, signature = entry.partition(",")
        if version == "v1" and hmac.compare_digest(signature, expected):
            return True
    return False

import express from "express";
import { verifyHubFitWebhook } from "./verify.js";

const app = express();
const handled = new Set(); // Use your database in production.

app.post("/hubfit-webhooks", express.raw({ type: "application/json" }), async (req, res) => {
  if (!verifyHubFitWebhook(req.body.toString(), req.headers, process.env.HUBFIT_WEBHOOK_SECRET)) {
    return res.sendStatus(401);
  }
  // Reply first: the 10 seconds HubFit waits include your work.
  res.sendStatus(200);

  const event = JSON.parse(req.body);
  if (handled.has(event.id)) return; // The same id on every retry.
  handled.add(event.id);

  if (event.type === "check_in_submission.created") {
    const response = await fetch(`https://api.hubfit.com/v1/check-in-submissions/${event.data.id}`, {
      headers: { Authorization: `Bearer ${process.env.HUBFIT_API_KEY}` },
    });
    // Deleted, archived or out of the key's reach since: skip it.
    if (response.status === 404 || response.status === 409) return;
    const { data: submission } = await response.json();
    // ...
  }
});