Get notified when something happens

pnpm everyapp events add https://hooks.example.com/everyapp --events 'cap.*,member.*'

pnpm everyapp events add --email admins --events 'member.*'

import { createHmac, timingSafeEqual } from "node:crypto";
import { createServer } from "node:http";

const SECRET = process.env.EVERYAPP_WEBHOOK_SECRET;

export function verifyEveryApp(
  secret,
  header,
  rawBody,
  now = Date.now() / 1000,
) {
  let timestamp = null;
  const signatures = [];
  for (const part of (header ?? "").split(",")) {
    const [key, value = ""] = part.trim().split("=", 2);
    if (key === "t" && /^\d+$/.test(value)) timestamp = Number(value);
    if (key === "v1") signatures.push(Buffer.from(value, "hex"));
  }
  if (timestamp === null || signatures.length === 0) return false;
  if (Math.abs(now - timestamp) > 300) return false;
  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.`)
    .update(rawBody)
    .digest();
  return signatures.some(
    (given) =>
      given.length === expected.length && timingSafeEqual(given, expected),
  );
}

createServer((req, res) => {
  const chunks = [];
  req.on("data", (chunk) => chunks.push(chunk));
  req.on("end", () => {
    const body = Buffer.concat(chunks);
    if (!verifyEveryApp(SECRET, req.headers["x-everyapp-signature"], body)) {
      res.writeHead(400).end("bad signature");
      return;
    }
    const event = JSON.parse(body.toString("utf8"));
    console.log(event.type, event.id);
    res.writeHead(200).end("ok");
  });
}).listen(Number(process.env.PORT ?? 3000));

import hashlib
import hmac
import json
import os
import time
from http.server import BaseHTTPRequestHandler, HTTPServer

SECRET = os.environ["EVERYAPP_WEBHOOK_SECRET"]


def verify_everyapp(secret, header, raw_body, now=None):
    timestamp = None
    signatures = []
    for part in (header or "").split(","):
        key, _, value = part.strip().partition("=")
        if key == "t" and value.isascii() and value.isdigit():
            timestamp = int(value)
        elif key == "v1":
            signatures.append(value.encode())
    if timestamp is None or not signatures:
        return False
    if abs((now or time.time()) - timestamp) > 300:
        return False
    expected = hmac.new(
        secret.encode(), f"{timestamp}.".encode() + raw_body, hashlib.sha256
    ).hexdigest().encode()
    return any(hmac.compare_digest(expected, given) for given in signatures)


class Handler(BaseHTTPRequestHandler):
    def do_POST(self):
        body = self.rfile.read(int(self.headers.get("Content-Length", 0)))
        if not verify_everyapp(SECRET, self.headers.get("X-EveryApp-Signature"), body):
            self.send_response(400)
            self.end_headers()
            return
        event = json.loads(body)
        print(event["type"], event["id"])
        self.send_response(200)
        self.end_headers()


HTTPServer(("", int(os.environ.get("PORT", "3000"))), Handler).serve_forever()

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"log"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)

func verifyEveryApp(secret, header string, body []byte, now time.Time) bool {
	timestamp := int64(-1)
	var signatures [][]byte
	for _, part := range strings.Split(header, ",") {
		key, value, _ := strings.Cut(strings.TrimSpace(part), "=")
		switch key {
		case "t":
			if t, err := strconv.ParseInt(value, 10, 64); err == nil && t >= 0 {
				timestamp = t
			}
		case "v1":
			if sig, err := hex.DecodeString(value); err == nil {
				signatures = append(signatures, sig)
			}
		}
	}
	if timestamp < 0 || len(signatures) == 0 {
		return false
	}
	age := now.Unix() - timestamp
	if age > 300 || age < -300 {
		return false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(strconv.FormatInt(timestamp, 10) + "."))
	mac.Write(body)
	expected := mac.Sum(nil)
	for _, sig := range signatures {
		if hmac.Equal(sig, expected) {
			return true
		}
	}
	return false
}

func main() {
	secret := os.Getenv("EVERYAPP_WEBHOOK_SECRET")
	port := os.Getenv("PORT")
	if port == "" {
		port = "3000"
	}
	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		body, err := io.ReadAll(io.LimitReader(r.Body, 1<<20))
		if err != nil || !verifyEveryApp(secret, r.Header.Get("X-EveryApp-Signature"), body, time.Now()) {
			http.Error(w, "bad signature", http.StatusBadRequest)
			return
		}
		log.Println(r.Header.Get("X-EveryApp-Event"), r.Header.Get("X-EveryApp-Event-Id"))
		w.WriteHeader(http.StatusOK)
	})
	log.Fatal(http.ListenAndServe(":"+port, nil))
}

pnpm everyapp events deliveries --dead
pnpm everyapp events redeliver <delivery id>