Webhooks

import * as crypto from 'crypto';
import {Buffer} from 'node:buffer';

// Your webhook token, stored securely (e.g., as an environment variable)
const WEBHOOK_TOKEN = 'U291dGggUGFyayAtIE1lZGljaW5hbCBGcmllZCBDaGlja2Vu';
// The body of the webhook, as it was sent to you and before any parsing is performed.
const RAW_BODY = '{"foo":"bar","baz":"qux"}'
// The headers of the webhook. All 5 are required in order to pass verification.
const HEADERS = {
   'X-Rillet-Signature': 's1HZBdKVbE/9h3qxJtAWb5M+BX5MfkMt9g9mTZFT19c=, c29tZSByYW5kb20gc2lnbmF0dXJlIGkgaGFkIHRvIG1ha2UgdXA=',
   'X-Rillet-Timestamp': '2025-07-29T02:52:25Z',
   'X-Rillet-Id': '01985418-1440-77ac-8741-eff80aec8fb0',
   'X-Rillet-Entity': 'INVOICE',
   'X-Rillet-Event': 'CREATED',
}

function verifySignatures(webhookSignatures: string[], token: string, signedPayload: string) {
   let verified = false;
   for (const webhookSignature of webhookSignatures) {
      const expectedSignature = crypto
              .createHmac('sha256', Buffer.from(token, 'base64'))
              .update(signedPayload)
              .digest('base64');

      const receivedSigBuffer = Buffer.from(webhookSignature, 'base64');
      const expectedSigBuffer = Buffer.from(expectedSignature, 'base64');

      if (
              receivedSigBuffer.length === expectedSigBuffer.length &&
              crypto.timingSafeEqual(receivedSigBuffer, expectedSigBuffer)
      ) {
         verified = true;
         break;
      }
   }
   return verified;
}

/**
 * Verifies the signature of an incoming Rillet webhook.
 * Throws an error if the signature is invalid or headers are missing.
 */
export function verifyRilletWebhook(
        headers: Record<string, string>,
        rawBody: string,
        token: string
): void {
   const webhookSignatures = headers['X-Rillet-Signature']?.split(',').map(s => s.trim()) || [];
   const webhookTimestamp = headers['X-Rillet-Timestamp'];
   const webhookEventId = headers['X-Rillet-Id'];
   const webhookEntity = headers['X-Rillet-Entity'];
   const webhookEvent = headers['X-Rillet-Event'];

   if (
           webhookSignatures.length === 0 ||
           webhookSignatures.length > 10 ||
           !webhookTimestamp ||
           !webhookEventId ||
           !webhookEntity ||
           !webhookEvent
   ) {
      throw new Error('Missing required Rillet webhook headers or too many signatures.');
   }

   const signedPayload = `${webhookTimestamp}.${webhookEventId}.${webhookEntity}.${webhookEvent}.${rawBody}`;
   let verified = verifySignatures(webhookSignatures, token, signedPayload);

   if (!verified) {
      throw new Error(`Invalid webhook signature. Could not verify any signature.`);
   }

   console.log('Webhook signature verified successfully.');
}

verifyRilletWebhook(HEADERS, RAW_BODY, WEBHOOK_TOKEN)

import hashlib
import hmac
import base64

# Your webhook token, stored securely (e.g., as an environment variable)
WEBHOOK_TOKEN = 'U291dGggUGFyayAtIE1lZGljaW5hbCBGcmllZCBDaGlja2Vu'
# The body of the webhook, as it was sent to you and before any parsing is performed.
RAW_BODY = '{"foo":"bar","baz":"qux"}'
# The headers of the webhook. All 5 are required in order to pass verification.
HEADERS = {
   'X-Rillet-Signature': 's1HZBdKVbE/9h3qxJtAWb5M+BX5MfkMt9g9mTZFT19c=, c29tZSByYW5kb20gc2lnbmF0dXJlIGkgaGFkIHRvIG1ha2UgdXA=',
   'X-Rillet-Timestamp': '2025-07-29T02:52:25Z',
   'X-Rillet-Id': '01985418-1440-77ac-8741-eff80aec8fb0',
   'X-Rillet-Entity': 'INVOICE',
   'X-Rillet-Event': 'CREATED',
}


def verify_rillet_webhook(headers, raw_body, token):
   """
   Verifies the signature of an incoming Rillet webhook.
   Raises an exception if the signature is invalid, headers are missing, or too many signatures are present.
   """
   webhook_signatures = [s.strip() for s in headers.get('X-Rillet-Signature', '').split(',') if s.strip()]
   webhook_timestamp = headers.get('X-Rillet-Timestamp')
   webhook_event_id = headers.get('X-Rillet-Id')
   webhook_entity = headers.get('X-Rillet-Entity')
   webhook_event = headers.get('X-Rillet-Event')

   if (
           not webhook_signatures or
           len(webhook_signatures) > 10 or
           not webhook_timestamp or
           not webhook_event_id or
           not webhook_entity or
           not webhook_event
   ):
      raise ValueError('Missing required Rillet webhook headers or too many signatures.')

   signed_payload = f"{webhook_timestamp}.{webhook_event_id}.{webhook_entity}.{webhook_event}.{raw_body}"

   verified = verify_signatures(signed_payload, token, webhook_signatures)

   if not verified:
      raise ValueError(f"Invalid webhook signature. Could not verify any signature.")

   print('Webhook signature verified successfully.')


def verify_signatures(signed_payload, token, webhook_signatures):
   for webhook_signature in webhook_signatures:
      token_bytes = base64.b64decode(token)
      expected_signature = hmac.new(
         token_bytes,
         signed_payload.encode('utf-8'),
         hashlib.sha256
      ).digest()
      expected_signature_b64 = base64.b64encode(expected_signature).decode('utf-8')

      received_sig_bytes = base64.b64decode(webhook_signature)
      expected_sig_bytes = base64.b64decode(expected_signature_b64)

      if hmac.compare_digest(received_sig_bytes, expected_sig_bytes):
         return True
   return False


if __name__ == "__main__":
   verify_rillet_webhook(HEADERS, RAW_BODY, WEBHOOK_TOKEN)

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;
import java.util.Map;

public class RilletWebhookVerifier {

   private static final String WEBHOOK_TOKEN = "U291dGggUGFyayAtIE1lZGljaW5hbCBGcmllZCBDaGlja2Vu";
   private static final String RAW_BODY = "{\"foo\":\"bar\",\"baz\":\"qux\"}";
   private static final Map<String, String> HEADERS = Map.of(
           "X-Rillet-Signature", "s1HZBdKVbE/9h3qxJtAWb5M+BX5MfkMt9g9mTZFT19c=, c29tZSByYW5kb20gc2lnbmF0dXJlIGkgaGFkIHRvIG1ha2UgdXA=",
           "X-Rillet-Timestamp", "2025-07-29T02:52:25Z",
           "X-Rillet-Id", "01985418-1440-77ac-8741-eff80aec8fb0",
           "X-Rillet-Entity", "INVOICE",
           "X-Rillet-Event", "CREATED"
   );

   /**
    * Verifies the signature of an incoming Rillet webhook.
    * Throws an exception if the signature is invalid or headers are missing.
    */
   public static void verifyRilletWebhook(
           Map<String, String> headers,
           String rawBody,
           String token
   ) throws NoSuchAlgorithmException, InvalidKeyException {
      String webhookSignatureHeader = headers.get("X-Rillet-Signature");
      String webhookTimestamp = headers.get("X-Rillet-Timestamp");
      String webhookEventId = headers.get("X-Rillet-Id");
      String webhookEntity = headers.get("X-Rillet-Entity");
      String webhookEvent = headers.get("X-Rillet-Event");

      String[] webhookSignatures = webhookSignatureHeader == null ? new String[0] :
              java.util.Arrays.stream(webhookSignatureHeader.split(","))
                      .map(String::trim)
                      .filter(s -> !s.isEmpty())
                      .toArray(String[]::new);

      if (
              webhookSignatures.length == 0 ||
                      webhookSignatures.length > 10 ||
                      webhookTimestamp == null ||
                      webhookEventId == null ||
                      webhookEntity == null ||
                      webhookEvent == null
      ) {
         throw new IllegalArgumentException("Missing required Rillet webhook headers or too many signatures.");
      }

      String signedPayload = String.format("%s.%s.%s.%s.%s", webhookTimestamp, webhookEventId, webhookEntity, webhookEvent, rawBody);

      boolean verified = verifySignatures(token, webhookSignatures, signedPayload);

      if (!verified) {
         throw new SecurityException("Invalid webhook signature. Could not verify any signature.");
      }

      System.out.println("Webhook signature verified successfully.");
   }

   private static boolean verifySignatures(String token, String[] webhookSignatures, String signedPayload) throws NoSuchAlgorithmException, InvalidKeyException {
      for (String webhookSignature : webhookSignatures) {
         SecretKeySpec secretKeySpec = new SecretKeySpec(Base64.getDecoder().decode(token), "HmacSHA256");
         Mac mac = Mac.getInstance("HmacSHA256");
         mac.init(secretKeySpec);
         byte[] expectedSignatureBytes = mac.doFinal(signedPayload.getBytes(StandardCharsets.UTF_8));
         byte[] webhookSignatureBytes = Base64.getDecoder().decode(webhookSignature);

         if (MessageDigest.isEqual(webhookSignatureBytes, expectedSignatureBytes)) { // Ensure you use a constant-time comparison.
            return true;
         }
      }
      return false;
   }

   public static void main(String[] args) {
      try {
         verifyRilletWebhook(HEADERS, RAW_BODY, WEBHOOK_TOKEN);
      } catch (NoSuchAlgorithmException | InvalidKeyException e) {
         System.err.println("Error verifying webhook: " + e.getMessage());
      }
   }
}