Webhooks

Registrearje in HTTPS-endpoint en Debaty stjoert in POST sagau't der wat bart.

import { createHmac, timingSafeEqual } from 'node:crypto';

// Verify a Debaty webhook delivery, and reject anything that does not verify.
//   secret: the whsec_… shown once when you created the subscription
//   header: the X-Debaty-Signature request header (t=<seconds>,v1=<hex>)
//   body:   the raw, unparsed request body
function verifyDebatySignature(secret, header, body, toleranceSeconds = 300) {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')));
  const timestamp = Number(parts.t);
  if (!Number.isInteger(timestamp)) return false;

  // The timestamp is inside the signed material, so a captured delivery cannot be
  // replayed later under a fresh t — reject anything outside the window.
  if (Math.abs(Math.floor(Date.now() / 1000) - timestamp) > toleranceSeconds) return false;

  const expected = createHmac('sha256', secret).update(`${timestamp}.${body}`).digest('hex');
  if (expected.length !== (parts.v1 ?? '').length) return false;
  return timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}

1. Registrearje in endpoint

   Jou in HTTPS-URL op en kies de events dy'sto beharkje wolst. Fia de API hjit dat fjild eventTypes; de referinsje neamt de wearden dy't it akseptearret.

2. Ferifiearje de hantekening

   Eltse levering is ûndertekene mei dyn webhook-secret. Kontrolearje de hantekening foar'tst him fertrouwst.

3. Antwurdzje fluch

   Antwurdzje binnen in pear sekonden mei in 2xx. By in flater besiket Debaty it opnij.

4. Wat der wannear binnenkomt

   Do krigest post.created, debate.created en comment.created. Alles wat fia de API skreaun wurdt, jout krekt deselde events mei deselde fjilden as alles wat fia de webside skreaun wurdt — do hoechst dus nea in reaksje fan in minske te ûnderskieden fan dy fan in bot.