Webhooks

import hmac
import hashlib
import time
from flask import Flask, jsonify, request

def verify_webhook(request_body: bytes, headers: dict, secret: str) -> bool:
    """Verify webhook signature and timestamp."""
    signature = headers.get('X-Webhook-Signature')
    timestamp = headers.get('X-Webhook-Timestamp')
    
    if not signature or not timestamp:
        return False
    
    # Reject requests older than 5 minutes (replay attack prevention)
    if abs(time.time() - int(timestamp)) > 300:
        return False
    
    # Compute expected signature
    message = f"{timestamp}.{request_body.decode()}"
    expected = hmac.new(
        secret.encode(),
        message.encode(),
        hashlib.sha256
    ).hexdigest()
    
    # Constant-time comparison
    return hmac.compare_digest(expected, signature)


app = Flask(__name__)
WEBHOOK_SECRET = "your-signing-secret"

def get_tool_metadata(headers: dict) -> dict:
    return {
        "request_id": headers.get("X-VoiceAI-Request-Id"),
        "tool_name": headers.get("X-VoiceAI-Tool-Name"),
        "agent_id": headers.get("X-VoiceAI-Agent-Id"),
        "call_id": headers.get("X-VoiceAI-Call-Id"),
    }


@app.post('/webhooks/voice-events')
def handle_event_webhook():
    if not verify_webhook(request.data, request.headers, WEBHOOK_SECRET):
        return jsonify({"error": "Invalid signature"}), 401

    event = request.get_json(force=True)
    event_type = event.get("event")

    if event_type == 'call.started':
        print(f"Call started: {event['call_id']}")
    elif event_type == 'call.completed':
        print(f"Call completed: {event['call_id']}, duration: {event['data']['duration_seconds']}s")

    return jsonify({
        "status": "ok",
        "event": event_type,
        "call_id": event.get("call_id"),
    }), 200


@app.post('/webhooks/inbound-call')
def handle_inbound_call_webhook():
    if not verify_webhook(request.data, request.headers, WEBHOOK_SECRET):
        return jsonify({"error": "Invalid signature"}), 401

    payload = request.get_json(force=True)
    return jsonify({
        "agent_overrides": {
            "tts_params": {
                "voice_id": "voice_spanish_support",
                "temperature": 0.7,
            }
        },
    }), 200


# Tool routes do not use HMAC. Voice.ai sends metadata in headers instead.
@app.get('/webhooks/tools/search-kb')
def search_knowledge_base():
    print(f"Tool request: {get_tool_metadata(request.headers)}")
    return jsonify({
        "result": {
            "matches": [
                {
                    "title": "Refund policy",
                    "snippet": "Customers can request a refund within 30 days.",
                }
            ],
            "query": request.args.get("query"),
            "top_k": int(request.args.get("top_k", "3")),
        }
    }), 200


@app.post('/webhooks/tools/account-status')
def get_account_status():
    print(f"Tool request: {get_tool_metadata(request.headers)}")
    payload = request.get_json(silent=True) or {}
    return jsonify({
        "result": {
            "status": "active",
            "tier": "enterprise",
            "customer_id": payload.get("customer_id"),
        }
    }), 200

const crypto = require('crypto');
const express = require('express');

const app = express();
const WEBHOOK_SECRET = 'your-signing-secret';
const signedJson = express.raw({ type: 'application/json' });
const jsonParser = express.json();

function verifyWebhook(body, headers, secret) {
  const signature = headers['x-webhook-signature'];
  const timestamp = headers['x-webhook-timestamp'];
  
  if (!signature || !timestamp) {
    return false;
  }
  
  // Reject requests older than 5 minutes
  if (Math.abs(Date.now() / 1000 - parseInt(timestamp, 10)) > 300) {
    return false;
  }
  
  // Compute expected signature
  const message = `${timestamp}.${body}`;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(message)
    .digest('hex');

  // Constant-time comparison
  const expectedBuffer = Buffer.from(expected, 'utf8');
  const signatureBuffer = Buffer.from(signature, 'utf8');
  return expectedBuffer.length === signatureBuffer.length
    && crypto.timingSafeEqual(expectedBuffer, signatureBuffer);
}

function getToolMetadata(headers) {
  return {
    request_id: headers['x-voiceai-request-id'],
    tool_name: headers['x-voiceai-tool-name'],
    agent_id: headers['x-voiceai-agent-id'],
    call_id: headers['x-voiceai-call-id'],
  };
}

app.post('/webhooks/voice-events', signedJson, (req, res) => {
  if (!verifyWebhook(req.body.toString('utf8'), req.headers, WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = JSON.parse(req.body.toString('utf8'));

  if (event.event === 'call.started') {
    console.log(`Call started: ${event.call_id}`);
  } else if (event.event === 'call.completed') {
    console.log(`Call completed: ${event.call_id}, duration: ${event.data.duration_seconds}s`);
  }

  res.json({
    status: 'ok',
    event: event.event,
    call_id: event.call_id,
  });
});

app.post('/webhooks/inbound-call', signedJson, (req, res) => {
  if (!verifyWebhook(req.body.toString('utf8'), req.headers, WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const payload = JSON.parse(req.body.toString('utf8'));
  res.json({
    agent_overrides: {
      tts_params: {
        voice_id: 'voice_spanish_support',
        temperature: 0.7,
      },
    },
  });
});

// Tool routes do not use HMAC. Voice.ai sends metadata in headers instead.
app.get('/webhooks/tools/search-kb', (req, res) => {
  console.log('Tool request:', getToolMetadata(req.headers));
  res.json({
    result: {
      matches: [
        {
          title: 'Refund policy',
          snippet: 'Customers can request a refund within 30 days.',
        },
      ],
      query: req.query.query,
      top_k: Number.parseInt(req.query.top_k ?? '3', 10),
    },
  });
});

app.post('/webhooks/tools/account-status', jsonParser, (req, res) => {
  console.log('Tool request:', getToolMetadata(req.headers));
  res.json({
    result: {
      status: 'active',
      tier: 'enterprise',
      customer_id: req.body?.customer_id ?? null,
    },
  });
});

app.listen(3000);