A webhook consumer done right.

curl -s -X POST https://app.upfour.io/v1/webhook-subscriptions \
  -H "Authorization: Bearer $UP4_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://ops.example.com/hooks/up4",
    "events": ["monitor.status_changed", "incident.opened", "incident.resolved"]
  }'

import express from "express";
import { createHmac, timingSafeEqual } from "node:crypto";
import pg from "pg";

const app = express();
// During a secret rotation both are set; see "Rotate the secret" below.
const SECRETS = [process.env.UP4_WEBHOOK_SECRET, process.env.UP4_WEBHOOK_SECRET_PREVIOUS].filter(Boolean);
const db = new pg.Pool(); // up4_events(event_id text primary key, delivery_id text, event text, body text)

// secret:  the whsec_… string, whole, as the create or rotate call returned it
// header:  the X-Up4-Signature header, "t=<unix>,v1=<hex>"
// rawBody: the request body exactly as received (a Buffer), before JSON.parse
function verifyUp4Signature(secret, header, rawBody, now = Math.floor(Date.now() / 1000), tolerance = 300) {
  let timestamp = null;
  const signatures = [];
  for (const part of String(header ?? "").split(",")) {
    const at = part.indexOf("=");
    const key = at < 0 ? part : part.slice(0, at);
    const value = at < 0 ? "" : part.slice(at + 1);
    if (key === "t") timestamp = value;
    if (key === "v1") signatures.push(value);
  }
  if (timestamp === null || !/^[0-9]+$/.test(timestamp) || signatures.length === 0) return false;
  if (Math.abs(now - Number(timestamp)) > tolerance) return false;

  const expected = createHmac("sha256", secret).update(`${timestamp}.`).update(rawBody).digest();
  return signatures.some(
    (signature) => /^[0-9a-f]{64}$/i.test(signature) && timingSafeEqual(expected, Buffer.from(signature, "hex")),
  );
}

// express.raw, NOT express.json: the signature covers the raw bytes.
app.post("/hooks/up4", express.raw({ type: "application/json" }), async (req, res) => {
  const signature = req.header("X-Up4-Signature") ?? "";
  if (!SECRETS.some((secret) => verifyUp4Signature(secret, signature, req.body))) {
    return res.status(401).end();
  }
  let payload;
  try { payload = JSON.parse(req.body); } catch { return res.status(400).end(); }

  try {
    // Store first. The event id is the same on every retry and on a manual
    // redelivery, so the primary key makes a repeat a no-op. (The delivery id
    // changes on a redelivery.)
    await db.query(
      "INSERT INTO up4_events (event_id, delivery_id, event, body) VALUES ($1, $2, $3, $4) ON CONFLICT (event_id) DO NOTHING",
      [payload.id, req.header("X-Up4-Delivery"), req.header("X-Up4-Event"), req.body.toString("utf8")],
    );
  } catch {
    return res.status(500).end(); // nothing stored: up4 retries
  }
  res.status(200).end(); // stored, safe to acknowledge
});

// A worker reads stored rows and does the real work.
async function handle({ event, body }) {
  const payload = JSON.parse(body);
  switch (event) {
    case "incident.opened":
      // page your own systems, open a ticket, dim the lights …
      break;
    case "monitor.status_changed":
      // payload.data.state is UP or DOWN
      break;
  }
}

app.listen(8787);