Webhooks

const crypto = require("crypto");

// Use express.raw() to get the raw body for signature verification.
// express.json() parses the body, which changes the bytes and breaks HMAC.
app.post("/webhooks/frame",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const rawBody = req.body; // Buffer
    const signature = req.headers["x-frame-signature"];
    const event = req.headers["x-frame-event"];

    // Verify signature
    const expected = "sha256=" +
      crypto.createHmac("sha256", process.env.FRAME_WEBHOOK_SECRET)
        .update(rawBody)
        .digest("hex");

    if (!crypto.timingSafeEqual(
      Buffer.from(expected),
      Buffer.from(signature)
    )) {
      return res.status(401).send("Invalid signature");
    }

    const payload = JSON.parse(rawBody);

    if (event === "capability.activated") {
      const capability = payload.data.object;
      console.log(
        `Capability ${capability.name} is now active ` +
        `for account ${capability.account_id}`
      );
      // Enable the feature in your platform
    }

    res.status(200).send("OK");
  }
);

class WebhooksController < ActionController::Base
  skip_before_action :verify_authenticity_token

  def create
    raw_body  = request.raw_post
    signature = request.headers["X-Frame-Signature"]
    event     = request.headers["X-Frame-Event"]

    # Verify HMAC-SHA256 signature
    expected = "sha256=" + OpenSSL::HMAC.hexdigest(
      "sha256",
      ENV["FRAME_WEBHOOK_SECRET"],
      raw_body
    )

    unless Rack::Utils.secure_compare(expected, signature)
      head :unauthorized and return
    end

    payload = JSON.parse(raw_body)

    case event
    when "capability.activated"
      handle_capability_activated(payload)
    when "account.activated"
      handle_account_activated(payload)
    end

    head :ok
  end

  private

  def handle_capability_activated(payload)
    capability = payload.dig("data", "object")
    account = Account.find_by(
      frame_account_id: capability["account_id"]
    )
    # Enable features based on capability name
  end
end