Webhooks

body='{"data":{"action_url":"https://luranta.com/signals/monitors","resource_ids":[],"schema_version":1,"summary":"A monitored hiring signal changed.","title":"Hiring signal update"},"delivery_id":"019c0000-0000-7000-8000-000000000201","event_id":"019c0000-0000-7000-8000-000000000202","event_type":"integration.test","occurred_at":"2026-08-02T12:00:00.000Z","schema_version":1}'
timestamp=$(date +%s)
signature=$(printf '%s' "v0.$timestamp.$body" \
  | openssl dgst -sha256 -hmac "$LURANTA_WEBHOOK_SECRET" -hex \
  | awk '{print $NF}')

curl --request POST "http://localhost:8787/luranta-webhook" \
  --header "Content-Type: application/json" \
  --header "X-Luranta-Event-Id: 019c0000-0000-7000-8000-000000000202" \
  --header "X-Luranta-Delivery-Id: 019c0000-0000-7000-8000-000000000201" \
  --header "X-Luranta-Event-Type: integration.test" \
  --header "X-Luranta-Timestamp: $timestamp" \
  --header "X-Luranta-Signature: v0=$signature" \
  --data-binary "$body"

const encoder = new TextEncoder()

function hexBytes(value: string): Uint8Array {
  if (!/^[0-9a-f]{64}$/.test(value)) throw new Error("Invalid signature")
  return Uint8Array.from(value.match(/.{2}/g)!, (byte) => Number.parseInt(byte, 16))
}

export async function verifyLurantaWebhook(request: Request, secret: string) {
  const timestamp = request.headers.get("X-Luranta-Timestamp")
  const signature = request.headers.get("X-Luranta-Signature")
  if (!timestamp || !signature?.startsWith("v0=")) return false

  const age = Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp))
  if (!Number.isSafeInteger(Number(timestamp)) || age > 300) return false

  const rawBody = await request.text()
  const key = await crypto.subtle.importKey(
    "raw",
    encoder.encode(secret),
    { name: "HMAC", hash: "SHA-256" },
    false,
    ["verify"],
  )
  return crypto.subtle.verify(
    "HMAC",
    key,
    hexBytes(signature.slice(3)),
    encoder.encode(`v0.${timestamp}.${rawBody}`),
  )
}

import hashlib
import hmac
import time

def verify_luranta_webhook(raw_body: bytes, headers, secret: str) -> bool:
    timestamp = headers.get("X-Luranta-Timestamp")
    signature = headers.get("X-Luranta-Signature")
    if not timestamp or not signature or not signature.startswith("v0="):
        return False
    try:
        if abs(int(time.time()) - int(timestamp)) > 300:
            return False
    except ValueError:
        return False

    signed = b"v0." + timestamp.encode() + b"." + raw_body
    expected = "v0=" + hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)