Add the webhooks resource and a signature verifier - #9
Open
0xFantomMenace wants to merge 1 commit into
Open
0xFantomMenace wants to merge 1 commit into
0xFantomMenace wants to merge 1 commit into
Conversation
Eighteen operations covering endpoints, subscriptions, watched addresses, the delivery log, and the two previews. Sync and async clients both. oxarchive/webhook_signature.py verifies a delivery. It takes the raw request bytes rather than a parsed object, because the body we sign is PostgreSQL's rendering of the payload and re-serialising it will not reproduce those bytes. It collects every v1 in the header, so a receiver holding both secrets keeps verifying through a rotation, and it compares in constant time. Free plans do not include webhooks. Estimates and dry-runs stay open on every plan for event types that are not scoped to a watched wallet.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Eighteen operations covering endpoints, subscriptions, watched addresses, the delivery log, and the two previews, on both the sync and async clients.
oxarchive/webhook_signature.pyverifies a delivery. Three things about it are deliberate:It takes the raw request bytes, not a parsed object. The body we sign is PostgreSQL's rendering of the payload, so re-serialising a parsed dict will not reproduce those bytes and verification will fail intermittently in a way that is very hard to debug.
It collects every
v1in the header. During a secret rotation the server sends two signatures over the same payload, one per secret, so a receiver holding either secret keeps working through the 24 hour overlap.It compares in constant time.
Free plans do not include webhook delivery. Estimates and dry runs stay open on every plan for event types that are not scoped to a watched wallet, so you can size a rule before paying for it.
Stacked on the packaging fix, so this PR shows only the webhooks commit. Retarget to main once that merges.