Monitor Notifications

import hashlib
import hmac
import json
import sqlite3
import time

import requests
from flask import Flask, abort, request

API_KEY = "YOUR_API_KEY"
BASE_URL = "https://api.sixtyfour.ai"
SECRET = "sk_whsec_..."  # store in a secret manager
TOLERANCE = 300

app = Flask(__name__)


def monitor_for_row(row_id: str):
    # Read-only, opened per lookup: the receiver can start before the creation
    # script has made the database, and never needs write access to it.
    try:
        with sqlite3.connect("file:monitors.db?mode=ro", uri=True) as db:
            found = db.execute(
                "SELECT monitor_id FROM monitor_rows WHERE row_id = ?", (row_id,)
            ).fetchone()
    except sqlite3.OperationalError:  # database or table not created yet
        return None
    return found[0] if found else None


def verify(raw: bytes, header: str, secret: str) -> bool:
    parts = [p.strip() for p in header.split(",")]
    try:
        t = int(next(p.split("=", 1)[1] for p in parts if p.startswith("t=")))
    except (StopIteration, ValueError):
        return False
    if abs(int(time.time()) - t) > TOLERANCE:
        return False
    expected = hmac.new(
        secret.encode("utf-8"), f"{t}.".encode("utf-8") + raw, hashlib.sha256
    ).hexdigest()
    return any(
        p.startswith("v1=") and hmac.compare_digest(expected, p.split("=", 1)[1])
        for p in parts
    )


@app.post("/hooks/sixtyfour")
def monitor_notification():
    raw = request.get_data()  # raw bytes, before JSON parse
    if not verify(raw, request.headers.get("Sixtyfour-Signature", ""), SECRET):
        abort(400)
    body = json.loads(raw)
    if body["type"] != "monitor.field.changed":
        return "", 204

    row_id = body["monitor_id"]
    monitor_id = monitor_for_row(row_id)
    if monitor_id is None:
        return "", 204  # not a row this receiver created

    events = requests.get(
        f"{BASE_URL}/monitors/{monitor_id}/rows/{row_id}/events",
        headers={"x-api-key": API_KEY},
        params={"event_group_id": body["event_group_id"], "limit": 500},
    )
    events.raise_for_status()
    for event in events.json():
        if event["event_type"] == "change":
            print(event["field"], event["previous_value"], "->", event["current_value"])
    return "", 204

import crypto from "crypto";
import express from "express";
import Database from "better-sqlite3";

const API_KEY = "YOUR_API_KEY";
const BASE_URL = "https://api.sixtyfour.ai";
const SECRET = process.env.SIXTYFOUR_WEBHOOK_SECRET;
const TOLERANCE = 300;
// Read-only, opened per lookup: the receiver can start before the creation
// script has made the database, and never needs write access to it.
function monitorForRow(rowId) {
  let db;
  try {
    db = new Database("monitors.db", { readonly: true, fileMustExist: true });
    return db.prepare("SELECT monitor_id FROM monitor_rows WHERE row_id = ?").get(rowId)?.monitor_id;
  } catch {
    return undefined; // database or table not created yet
  } finally {
    db?.close();
  }
}

const app = express();
app.use(express.raw({ type: "application/json" }));

function verify(raw, header, secret) {
  const parts = header.split(",").map((p) => p.trim());
  const tPart = parts.find((p) => p.startsWith("t="));
  if (!tPart) return false;
  const t = parseInt(tPart.slice(2), 10);
  if (!Number.isFinite(t)) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > TOLERANCE) return false;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(Buffer.concat([Buffer.from(`${t}.`), raw]))
    .digest("hex");
  return parts.some((p) => {
    if (!p.startsWith("v1=")) return false;
    const got = Buffer.from(p.slice(3), "utf8");
    const exp = Buffer.from(expected, "utf8");
    return got.length === exp.length && crypto.timingSafeEqual(got, exp);
  });
}

app.post("/hooks/sixtyfour", async (req, res) => {
  if (!verify(req.body, req.header("Sixtyfour-Signature") || "", SECRET)) {
    return res.status(400).send("invalid signature");
  }
  const body = JSON.parse(req.body.toString("utf8"));
  if (body.type !== "monitor.field.changed") return res.sendStatus(204);

  const rowId = body.monitor_id;
  const monitorId = monitorForRow(rowId);
  if (!monitorId) return res.sendStatus(204); // not a row this receiver created

  const params = new URLSearchParams({ event_group_id: body.event_group_id, limit: "500" });
  const response = await fetch(
    `${BASE_URL}/monitors/${monitorId}/rows/${rowId}/events?${params}`,
    { headers: { "x-api-key": API_KEY } },
  );
  if (!response.ok) return res.status(502).send("could not read events");
  const events = await response.json();
  for (const event of events.filter((e) => e.event_type === "change")) {
    console.log(event.field, event.previous_value, "->", event.current_value);
  }
  res.sendStatus(204);
});

app.listen(3000);