Fire jobs. Get a clean callback.

import crypto from 'crypto';
import express from 'express';

const app = express();
app.use(express.raw({ type: 'application/json' })); // raw bytes for HMAC

app.post('/hooks/ollagraph', (req, res) => {
  const header = req.headers['x-ollagraph-signature'] || '';
  // Header format: "t=<unix_ts>,v1=<hex_hmac_sha256>"
  const parts = Object.fromEntries(header.split(',').map(p => p.split('=')));
  const ts = parts.t, sig = parts.v1;

  // Reject anything older than five minutes (defeats replay).
  if (!ts || Math.abs(Date.now() / 1000 - Number(ts)) > 300) {
    return res.status(401).send('stale or missing timestamp');
  }

  // Signed body is: <ts>.<exact_json_bytes>
  const expected = crypto
    .createHmac('sha256', process.env.OLLAGRAPH_WEBHOOK_SECRET)
    .update(`${ts}.`)
    .update(req.body) // raw bytes, not re-serialized JSON
    .digest('hex');

  if (!sig || !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
    return res.status(401).send('invalid signature');
  }

  // Acknowledge fast, then process out of band — see the idempotency note.
  const { job_id, result } = JSON.parse(req.body);
  res.sendStatus(200);
});

import hmac, hashlib, os, time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["OLLAGRAPH_WEBHOOK_SECRET"].encode()

@app.post("/hooks/ollagraph")
def callback():
    header = request.headers.get("x-ollagraph-signature", "")
    # Header format: "t=<unix_ts>,v1=<hex_hmac_sha256>"
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    ts, sig = parts.get("t"), parts.get("v1")
    if not ts or abs(time.time() - int(ts)) > 300:
        abort(401)
    body = request.get_data()  # raw bytes
    # Signed body is: <ts>.<exact_json_bytes>
    expected = hmac.new(SECRET, f"{ts}.".encode() + body, hashlib.sha256).hexdigest()
    if not sig or not hmac.compare_digest(sig, expected):
        abort(401)
    payload = request.get_json()
    # process payload["result"] ... then return fast
    return "", 200