Webhooks de Feed

curl -X POST "https://app.alana.shopping/api/v1/feeds/google/webhooks" \
  -H "X-API-Key: sk_live_sua_chave_api" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://seuservidor.com/webhooks/alana",
    "events": ["feed.generated", "feed.failed"],
    "secret": "seu_segredo_webhook"
  }'

const res = await fetch(
  "https://app.alana.shopping/api/v1/feeds/google/webhooks",
  {
    method: "POST",
    headers: {
      "X-API-Key": "sk_live_sua_chave_api",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      url: "https://seuservidor.com/webhooks/alana",
      events: ["feed.generated", "feed.failed"],
      secret: "seu_segredo_webhook",
    }),
  }
);
const assinatura = await res.json();

import requests

res = requests.post(
    "https://app.alana.shopping/api/v1/feeds/google/webhooks",
    headers={
        "X-API-Key": "sk_live_sua_chave_api",
        "Content-Type": "application/json",
    },
    json={
        "url": "https://seuservidor.com/webhooks/alana",
        "events": ["feed.generated", "feed.failed"],
        "secret": "seu_segredo_webhook",
    },
)
assinatura = res.json()

import crypto from "crypto";

function verificarAssinatura(payload, assinatura, segredo) {
  const esperado = crypto
    .createHmac("sha256", segredo)
    .update(payload, "utf8")
    .digest("hex");
  const recebido = assinatura.replace("sha256=", "");
  return crypto.timingSafeEqual(
    Buffer.from(esperado, "hex"),
    Buffer.from(recebido, "hex")
  );
}

// Exemplo com Express:
app.post("/webhooks/alana", (req, res) => {
  const assinatura = req.headers["x-alana-signature"];
  const valido = verificarAssinatura(
    JSON.stringify(req.body),
    assinatura,
    process.env.WEBHOOK_SECRET
  );

  if (!valido) return res.status(401).send("Assinatura inválida");

  const { event, platform, product_count } = req.body;
  console.log(`Feed ${event} para ${platform}: ${product_count} produtos`);
  res.sendStatus(200);
});

import hmac
import hashlib

def verificar_assinatura(payload: bytes, assinatura: str, segredo: str) -> bool:
    esperado = hmac.new(
        segredo.encode(), payload, hashlib.sha256
    ).hexdigest()
    recebido = assinatura.replace("sha256=", "")
    return hmac.compare_digest(esperado, recebido)

# Exemplo com Flask:
from flask import Flask, request, abort

app = Flask(__name__)

@app.post("/webhooks/alana")
def handle_webhook():
    assinatura = request.headers.get("X-Alana-Signature", "")
    if not verificar_assinatura(request.data, assinatura, WEBHOOK_SECRET):
        abort(401)

    data = request.json
    print(f"Feed {data['event']} para {data['platform']}")
    return "", 200