In-App Reward Webhooks

import express from 'express';
import crypto from 'node:crypto';

const app = express();
const SECRET = process.env.INVITEBASE_WEBHOOK_SECRET!;
const API_KEY = process.env.INVITEBASE_SECRET_KEY!;
const TOLERANCE_S = 300;

app.post(
  '/webhooks/invitebase',
  express.raw({ type: 'application/json' }), // raw body — required for verification
  async (req, res) => {
    const header = req.header('Invitebase-Signature') ?? '';
    const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')));
    const expected = crypto
      .createHmac('sha256', SECRET)
      .update(`${parts.t}.${req.body}`)
      .digest('hex');

    const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < TOLERANCE_S;
    const valid =
      parts.v1?.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(parts.v1), Buffer.from(expected));
    if (!fresh || !valid) return res.status(401).send('bad signature');

    const event = JSON.parse(req.body.toString());
    if (event.type !== 'reward.pending') return res.sendStatus(200);

    const { idempotency_key } = event;
    const { reward_id, recipient, method, config, referral, referrer } = event.data;

    // Idempotency: unique index on processed_webhooks.idempotency_key
    const inserted = await db.processedWebhooks.insertIgnore({ idempotencyKey: idempotency_key });
    if (!inserted) return res.sendStatus(200); // duplicate delivery

    // These are the stable IDs your app supplied to Invitebase.
    const userId =
      recipient === 'referred_user'
        ? referral.referred_user_external_id
        : referrer.external_id;
    if (!userId) return res.status(400).send('missing recipient identity');

    if (method === 'free_access') {
      await db.users.extendEntitlement(userId, config.free_access_duration);
    } else if (method === 'in_app') {
      await db.users.grant(userId, config.in_app_payload);
    }

    // Confirm the grant — idempotent, safe to repeat on redelivery.
    await fetch(`https://api.invitebase.com/v1/rewards/${reward_id}/fulfill`, {
      method: 'POST',
      headers: { Authorization: `Bearer ${API_KEY}` },
    });

    res.sendStatus(200);
  }
);

app.listen(3000);

import hashlib, hmac, os, time

import httpx
from fastapi import FastAPI, Header, HTTPException, Request

app = FastAPI()
SECRET = os.environ["INVITEBASE_WEBHOOK_SECRET"]
API_KEY = os.environ["INVITEBASE_SECRET_KEY"]
API = "https://api.invitebase.com"
AUTH = {"Authorization": f"Bearer {API_KEY}"}
TOLERANCE_S = 300


@app.post("/webhooks/invitebase")
async def invitebase_webhook(request: Request, invitebase_signature: str = Header(...)):
    body = await request.body()  # raw body — required for verification
    parts = dict(p.split("=", 1) for p in invitebase_signature.split(","))
    expected = hmac.new(SECRET.encode(), f"{parts['t']}.".encode() + body, hashlib.sha256).hexdigest()

    fresh = abs(time.time() - int(parts["t"])) < TOLERANCE_S
    if not fresh or not hmac.compare_digest(parts.get("v1", ""), expected):
        raise HTTPException(status_code=401, detail="bad signature")

    event = await request.json()
    if event["type"] != "reward.pending":
        return {"ok": True}

    data = event["data"]

    # Idempotency: INSERT ... ON CONFLICT DO NOTHING on idempotency_key
    if not await db.record_webhook_once(event["idempotency_key"]):
        return {"ok": True}  # duplicate delivery

    async with httpx.AsyncClient(base_url=API, headers=AUTH) as invitebase:
        # These are the stable IDs your app supplied to Invitebase.
        if data["recipient"] == "referred_user":
            user_id = data["referral"]["referred_user_external_id"]
        else:
            user_id = data["referrer"]["external_id"]
        if not user_id:
            raise HTTPException(status_code=400, detail="missing recipient identity")

        cfg = data["config"]
        if data["method"] == "free_access":
            await db.extend_entitlement(user_id, cfg["free_access_duration"])
        elif data["method"] == "in_app":
            await db.grant(user_id, cfg["in_app_payload"])

        # Confirm the grant — idempotent, safe to repeat on redelivery.
        await invitebase.post(f"/v1/rewards/{data['reward_id']}/fulfill")

    return {"ok": True}