Webhooks

from flask import Flask, request, jsonify
import hmac, hashlib, json

app = Flask(__name__)
WEBHOOK_SECRET = "whsec_your_webhook_secret"

@app.route("/webhooks/mor", methods=["POST"])
def handle_webhook():
    # 1. Get the signature from headers
    signature = request.headers.get("X-MOR-Signature")
    timestamp = request.headers.get("X-MOR-Timestamp")

    if not signature or not timestamp:
        return jsonify({"error": "Missing signature"}), 401

    # 2. Construct the signed payload
    payload = f"{timestamp}.{request.get_data(as_text=True)}"

    # 3. Compute HMAC-SHA256
    expected = hmac.new(
        WEBHOOK_SECRET.encode(),
        payload.encode(),
        hashlib.sha256,
    ).hexdigest()

    # 4. Compare signatures (timing-safe)
    if not hmac.compare_digest(f"sha256={expected}", signature):
        return jsonify({"error": "Invalid signature"}), 401

    # 5. Parse and handle the event
    event = request.get_json()

    match event["type"]:
        case "receipt.created":
            handle_receipt(event["data"])
        case "payment.completed":
            handle_payment(event["data"])
        case "device.suspended":
            alert_ops_team(event["data"])

    return jsonify({"received": True}), 200

import { MorClient } from '@mor-api/sdk';
import express from 'express';

const app = express();
const WEBHOOK_SECRET = process.env.MOR_WEBHOOK_SECRET;

app.post('/webhooks/mor', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-mor-signature'];
  const timestamp = req.headers['x-mor-timestamp'];

  // Verify signature using the SDK helper
  const isValid = MorClient.webhooks.verify(
    req.body,
    signature,
    timestamp,
    WEBHOOK_SECRET
  );

  if (!isValid) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = JSON.parse(req.body);

  switch (event.type) {
    case 'receipt.created':
      console.log(`Receipt ${event.data.fiscal_code} created`);
      break;
    case 'payment.completed':
      console.log(`Payment ${event.data.bank_reference} confirmed`);
      break;
    case 'device.suspended':
      console.log(`Device ${event.data.serial_number} suspended`);
      break;
  }

  res.json({ received: true });
});