Monitor Notifications

import hashlib
import hmac
import json
import os
import time

import requests
from flask import Flask, abort, request

API_KEY = "YOUR_API_KEY"
BASE_URL = "https://api.sixtyfour.ai"
SECRET = os.environ["SIXTYFOUR_WEBHOOK_SECRET"]
TOLERANCE = 300

app = Flask(__name__)

def verify(raw: bytes, header: str, secret: str) -> bool:
    parts = [p.strip() for p in header.split(",")]
    try:
        t = int(next(p.split("=", 1)[1] for p in parts if p.startswith("t=")))
    except (StopIteration, ValueError):
        return False
    if abs(int(time.time()) - t) > TOLERANCE:
        return False
    expected = hmac.new(
        secret.encode("utf-8"), f"{t}.".encode("utf-8") + raw, hashlib.sha256
    ).hexdigest()
    return any(
        p.startswith("v1=") and hmac.compare_digest(expected, p.split("=", 1)[1])
        for p in parts
    )

@app.post("/hooks/sixtyfour")
def monitor_notification():
    raw = request.get_data()  # raw bytes, before JSON parse
    if not verify(raw, request.headers.get("Sixtyfour-Signature", ""), SECRET):
        abort(400)
    body = json.loads(raw)
    if body["type"] != "monitor.field.changed":
        return "", 204

    events = requests.get(
        f"{BASE_URL}/monitors/{body['monitor_id']}/rows/{body['row_id']}/events",
        headers={"x-api-key": API_KEY},
        params={"event_group_id": body["event_group_id"], "limit": 500},
    )
    events.raise_for_status()
    for event in events.json():
        if event["event_type"] == "change":
            print(event["field"], event["previous_value"], "->", event["current_value"])
    return "", 204

import crypto from "crypto";
import express from "express";

const API_KEY = "YOUR_API_KEY";
const BASE_URL = "https://api.sixtyfour.ai";
const SECRET = process.env.SIXTYFOUR_WEBHOOK_SECRET;
const TOLERANCE = 300;
const app = express();
app.use(express.raw({ type: "application/json" }));

function verify(raw, header, secret) {
  const parts = header.split(",").map((p) => p.trim());
  const tPart = parts.find((p) => p.startsWith("t="));
  if (!tPart) return false;
  const t = parseInt(tPart.slice(2), 10);
  if (!Number.isFinite(t)) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > TOLERANCE) return false;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(Buffer.concat([Buffer.from(`${t}.`), raw]))
    .digest("hex");
  return parts.some((p) => {
    if (!p.startsWith("v1=")) return false;
    const got = Buffer.from(p.slice(3), "utf8");
    const exp = Buffer.from(expected, "utf8");
    return got.length === exp.length && crypto.timingSafeEqual(got, exp);
  });
}

app.post("/hooks/sixtyfour", async (req, res) => {
  if (!verify(req.body, req.header("Sixtyfour-Signature") || "", SECRET)) {
    return res.status(400).send("invalid signature");
  }
  const body = JSON.parse(req.body.toString("utf8"));
  if (body.type !== "monitor.field.changed") return res.sendStatus(204);

  const params = new URLSearchParams({ event_group_id: body.event_group_id, limit: "500" });
  const response = await fetch(
    `${BASE_URL}/monitors/${body.monitor_id}/rows/${body.row_id}/events?${params}`,
    { headers: { "x-api-key": API_KEY } },
  );
  if (!response.ok) return res.status(502).send("could not read events");
  const events = await response.json();
  for (const event of events.filter((e) => e.event_type === "change")) {
    console.log(event.field, event.previous_value, "->", event.current_value);
  }
  res.sendStatus(204);
});

app.listen(3000);