Callbacks and Signature Verification

{
  "noticeId": "ntc_1f4d9a3c2b7e",
  "productId": 1,
  "eventType": 107,
  "notifyMs": 1793000000123,
  "sid": "prj_3f2a:channel_create",
  "payload": {
    "channelName": "weekly-sync",
    "platform": 7,
    "ts": 1793000000,
    "uid": 10001
  }
}

import { createHmac, timingSafeEqual } from 'node:crypto';

function safeEqualHex(a, b) {
  const left = Buffer.from(String(a).toLowerCase(), 'utf8');
  const right = Buffer.from(String(b).toLowerCase(), 'utf8');
  return left.length === right.length && timingSafeEqual(left, right);
}

/**
 * @param {string} secret  the callback secret configured in the console
 * @param {string} rawBody the raw request body string (not run through JSON.parse + stringify)
 * @param {Record<string,string|undefined>} headers
 */
export function verifyNimeetCallback(secret, rawBody, headers) {
  const hmac = (algorithm) => createHmac(algorithm, secret).update(rawBody, 'utf8').digest('hex');
  const v2 = headers['agora-signature-v2'];
  if (v2) return safeEqualHex(v2.replace(/^sha256=/, ''), hmac('sha256')) ? { ok: true, scheme: 'v2' } : { ok: false, reason: 'v2 mismatch' };
  const v1 = headers['agora-signature'];
  if (v1) return safeEqualHex(v1.replace(/^sha1=/, ''), hmac('sha1')) ? { ok: true, scheme: 'v1' } : { ok: false, reason: 'v1 mismatch' };
  return { ok: false, reason: 'missing signature headers' };
}

// Express example: keep the raw body
// app.post('/hooks/nimeet', express.raw({ type: 'application/json' }), (req, res) => {
//   const rawBody = req.body.toString('utf8');
//   const result = verifyNimeetCallback(process.env.NIMEET_WEBHOOK_SECRET, rawBody, req.headers);
//   if (!result.ok) return res.status(401).end();
//   const envelope = JSON.parse(rawBody);
//   if (seen.has(envelope.noticeId)) return res.status(200).end(); // idempotent
//   // ... handle envelope
//   res.status(200).end();
// });

import hashlib
import hmac
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = b"replace-with-a-long-random-secret"

def _safe_equal(expected_hex: str, provided_hex: str) -> bool:
    return hmac.compare_digest(expected_hex.lower().encode(), provided_hex.lower().encode())

@app.post("/hooks/nimeet")
def nimeet_webhook():
    raw = request.get_data(cache=True)  # raw bytes; do not use request.get_json()
    v2 = request.headers.get("Agora-Signature-V2")
    v1 = request.headers.get("Agora-Signature")
    if v2:
        expected = hmac.new(SECRET, raw, hashlib.sha256).hexdigest()
        if not _safe_equal(expected, v2.removeprefix("sha256=")):
            abort(401)
    elif v1:
        expected = hmac.new(SECRET, raw, hashlib.sha1).hexdigest()
        if not _safe_equal(expected, v1.removeprefix("sha1=")):
            abort(401)
    else:
        abort(401)

    envelope = request.get_json(silent=True) or {}
    if envelope.get("noticeId") in SEEN:      # idempotent: keep a unique key on noticeId
        return ("ok", 200)
    handle(envelope)
    return ("ok", 200)

#!/usr/bin/env bash
# 回调配置与投递日志（控制台会话）——需要先登录拿 Bearer session。
# 演示账号：owner@ni-meet.local / ni-meet-demo（CONSOLE_SEED_EMAIL/PASSWORD 可覆盖）
set -euo pipefail

: "${NIMEET_API_BASE:=http://127.0.0.1:8787}"
: "${CONSOLE_EMAIL:=owner@ni-meet.local}"
: "${CONSOLE_PASSWORD:=ni-meet-demo}"

# 1) 登录
SESSION=$(curl -s -X POST "$NIMEET_API_BASE/console/auth/login" \
  -H 'Content-Type: application/json' \
  -d "{\"email\":\"$CONSOLE_EMAIL\",\"password\":\"$CONSOLE_PASSWORD\"}" \
  | node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>process.stdout.write(JSON.parse(s).token))")
echo "session acquired"

# 2) 项目列表（取第一个项目 id）
PROJECT_ID=$(curl -s "$NIMEET_API_BASE/console/projects" -H "Authorization: Bearer $SESSION" \
  | node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>process.stdout.write(JSON.parse(s).projects[0].id))")
echo "projectId=$PROJECT_ID"

# 3) 查看/配置回调地址（secret 用于签名，至少 8 位）
curl -s "$NIMEET_API_BASE/console/projects/$PROJECT_ID/webhook" -H "Authorization: Bearer $SESSION"
curl -s -X PUT "$NIMEET_API_BASE/console/projects/$PROJECT_ID/webhook" \
  -H "Authorization: Bearer $SESSION" -H 'Content-Type: application/json' \
  -d '{"url":"https://example.com/hooks/nimeet","secret":"replace-with-a-long-random-secret","events":["channel_create","user_join","user_leave","recording_state_changed"],"enabled":true}'

# 4) 投递日志与重放
curl -s "$NIMEET_API_BASE/console/projects/$PROJECT_ID/webhook/deliveries?limit=20" -H "Authorization: Bearer $SESSION"
# curl -s -X POST "$NIMEET_API_BASE/console/projects/$PROJECT_ID/webhook/deliveries/<deliveryId>/replay" \
#   -H "Authorization: Bearer $SESSION"