Webhook 通知

{
  "event": "incident.created",
  "monitorName": "API Server",
  "monitorId": "01JWAB1234567890ABCDEF",
  "teamId": "01JWAB0987654321FEDCBA",
  "incidentId": "01JWABINCIDENT12345678",
  "monitorUrl": "https://api.example.com/health",
  "severity": "critical",
  "timestamp": "2025-01-15T10:30:00.000Z"
}

{
  "event": "incident.resolved",
  "monitorName": "API Server",
  "monitorId": "01JWAB1234567890ABCDEF",
  "teamId": "01JWAB0987654321FEDCBA",
  "incidentId": "01JWABINCIDENT12345678",
  "timestamp": "2025-01-15T10:45:00.000Z"
}

import crypto from "node:crypto";

function verifySignature(body, secret, signature) {
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(body).digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature),
  );
}

// Express の例
app.post("/webhook", express.text({ type: "application/json" }), (req, res) => {
  const signature = req.headers["x-manako-signature"];
  if (!verifySignature(req.body, process.env.WEBHOOK_SECRET, signature)) {
    return res.status(401).send("Invalid signature");
  }
  const payload = JSON.parse(req.body);
  console.log(`Event: ${payload.event}, Monitor: ${payload.monitorName}`);
  res.status(200).send("OK");
});

import hashlib
import hmac
import os

def verify_signature(body: bytes, secret: str, signature: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

# Flask の例
@app.route("/webhook", methods=["POST"])
def webhook():
    signature = request.headers.get("X-Manako-Signature", "")
    if not verify_signature(
        request.get_data(), os.environ["WEBHOOK_SECRET"], signature
    ):
        return "Invalid signature", 401
    payload = request.get_json()
    print(f"Event: {payload['event']}, Monitor: {payload['monitorName']}")
    return "OK", 200