Webhooks & Integrações
Opsellio

// IMPORTANTE: usar express.raw() antes do json() parser const crypto = require('crypto'); function verifyWebhook(rawBody, signatureHeader, secret) { const expected = 'sha256=' + crypto .createHmac('sha256', secret) .update(rawBody) // rawBody deve ser Buffer, não string .digest('hex'); // timingSafeEqual protege contra timing attacks return crypto.timingSafeEqual( Buffer.from(expected), Buffer.from(signatureHeader) ); } // Endpoint app.post('/webhook/opsellio', express.raw({type: '*/*'}), (req, res) => { const sig = req.headers['x-opsellio-signature']; if (!verifyWebhook(req.body, sig, process.env.OPSELLIO_WEBHOOK_SECRET)) { return res.status(401).json({ error: 'Assinatura inválida' }); } const event = JSON.parse(req.body.toString()); processEventAsync(event); // enfileirar e processar em background res.status(200).json({ received: true }); // responder IMEDIATAMENTE });

import hmac, hashlib, os def verify_webhook(raw_body: bytes, signature: str, secret: str) -> bool: expected = 'sha256=' + hmac.new( secret.encode(), raw_body, hashlib.sha256 ).hexdigest() return hmac.compare_digest(expected, signature) # Django view def webhook_view(request): sig = request.META.get('HTTP_X_OPSELLIO_SIGNATURE', '') if not verify_webhook(request.body, sig, os.environ['WEBHOOK_SECRET']): return JsonResponse({'error': 'Inválido'}, status=401) event = json.loads(request.body) process_event.delay(event) # Celery task — async return JsonResponse({'received': True})

// Redis — guardar IDs por 7 dias async function processWebhook(event) { const key = `webhook:processed:${event.id}`; const alreadyDone = await redis.get(key); if (alreadyDone) { console.log(`Evento duplicado ignorado: ${event.id}`); return; // retornar sem processar } await redis.set(key, '1', 'EX', 86400 * 7); // 7 dias de TTL await handleEvent(event); // processar uma única vez } // Handler por tipo de evento async function handleEvent(event) { switch (event.event) { case 'payment.completed': await grantAccess(event.data); break; case 'payment.refunded': case 'subscription.expired': case 'access.revoked': await revokeAccess(event.data); break; case 'subscription.cancelled': await scheduleRevoke(event.data.subscription.access_until, event.data); break; default: console.log(`Evento não tratado: ${event.event}`); } }