余额告警 Webhook

POST /webhook HTTP/1.1
Content-Type: application/json
X-Sigrunai-Event: balance.below_threshold
X-Sigrunai-Timestamp: 1756100000
X-Sigrunai-Signature: sha256=d7c4f8...

{
  "event": "balance.below_threshold",
  "user_id": 123,
  "available": 80.2,
  "threshold": 100,
  "occurred_at": "2026-08-25T07:00:00Z"
}

{
  "event": "balance.insufficient",
  "user_id": 123,
  "available": 1.5,
  "required": 8,
  "occurred_at": "2026-08-25T07:01:00Z"
}

HMAC_SHA256(secret, "{X-Sigrunai-Timestamp}.{raw_body}")

import crypto from 'node:crypto';

function verifyWebhook({ rawBody, timestamp, signatureHeader, secret }) {
  const expected =
    'sha256=' +
    crypto
      .createHmac('sha256', secret)
      .update(`${timestamp}.${rawBody}`)
      .digest('hex');
  const a = Buffer.from(signatureHeader || '', 'utf8');
  const b = Buffer.from(expected, 'utf8');
  if (a.length !== b.length) return false;
  return crypto.timingSafeEqual(a, b);
}

// Express: app.use(express.raw({ type: 'application/json' }))
app.post('/webhook', (req, res) => {
  const rawBody = req.body.toString('utf8');
  const ok = verifyWebhook({
    rawBody,
    timestamp: req.get('X-Sigrunai-Timestamp'),
    signatureHeader: req.get('X-Sigrunai-Signature'),
    secret: process.env.BALANCE_WEBHOOK_SECRET,
  });
  if (!ok) return res.status(401).end();
  const payload = JSON.parse(rawBody);
  // handle payload.event
  res.status(204).end();
});

import hashlib
import hmac

def verify_webhook(raw_body: bytes, timestamp: str, signature_header: str, secret: str) -> bool:
    digest = hmac.new(
        secret.encode("utf-8"),
        f"{timestamp}.".encode("utf-8") + raw_body,
        hashlib.sha256,
    ).hexdigest()
    expected = f"sha256={digest}"
    return hmac.compare_digest(signature_header, expected)