Events and webhooks: receive Telegram and iMessage messages

import express from "express";
import { FlowMessaging, contentText } from "@flow-engineer/messaging";

const flow = new FlowMessaging();
const app = express();

// The raw body is required: a parsed and re-serialized body will not match.
app.post("/flow", express.raw({ type: "application/json" }), async (req, res) => {
  let event;
  try {
    event = await flow.webhooks.constructEvent(req.body, req.header("Flow-Signature"), process.env.FLOW_MESSAGING_WEBHOOK_SECRET!);
  } catch {
    return res.status(400).end();
  }
  if (event.type === "message.received") {
    return res.json(flow.webhooks.reply(`You said: ${contentText(event.data.message.content)}`));
  }
  res.json({});
});

app.listen(3000);

# The Python SDK is not published yet, so this checks the signature by hand.
import hashlib, hmac, json, os, time
from fastapi import FastAPI, Request, Response

app = FastAPI()
SECRET = os.environ["FLOW_MESSAGING_WEBHOOK_SECRET"]

def verify(body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    fields = [part.strip().split("=", 1) for part in header.split(",") if "=" in part]
    t = next((v for k, v in fields if k == "t"), None)
    signatures = [v for k, v in fields if k == "v1"]
    if t is None or not t.isdigit() or abs(time.time() - int(t)) > tolerance:
        return False
    expected = hmac.new(secret.encode(), b"t." + t.encode() + b"." + body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(expected, s) for s in signatures)

@app.post("/flow")
async def flow_webhook(request: Request):
    body = await request.body()
    if not verify(body, request.headers.get("Flow-Signature", ""), SECRET):
        return Response(status_code=400)
    event = json.loads(body)
    if event["type"] == "message.received":
        text = event["data"]["message"]["content"].get("text", "")
        return {"reply": {"type": "text", "text": f"You said: {text}"}}
    return {}

// The Go SDK is not published yet, so this checks the signature by hand.
package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"io"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)

func verify(body []byte, header, secret string) bool {
	var ts string
	var sigs []string
	for _, part := range strings.Split(header, ",") {
		k, v, _ := strings.Cut(strings.TrimSpace(part), "=")
		switch k {
		case "t":
			ts = v
		case "v1":
			sigs = append(sigs, v)
		}
	}
	t, err := strconv.ParseInt(ts, 10, 64)
	if err != nil {
		return false
	}
	if d := time.Now().Unix() - t; d > 300 || d < -300 {
		return false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte("t." + ts + "."))
	mac.Write(body)
	want := hex.EncodeToString(mac.Sum(nil))
	for _, s := range sigs {
		if hmac.Equal([]byte(want), []byte(s)) {
			return true
		}
	}
	return false
}

func main() {
	secret := os.Getenv("FLOW_MESSAGING_WEBHOOK_SECRET")
	http.HandleFunc("/flow", func(w http.ResponseWriter, r *http.Request) {
		body, _ := io.ReadAll(r.Body)
		if !verify(body, r.Header.Get("Flow-Signature"), secret) {
			w.WriteHeader(http.StatusBadRequest)
			return
		}
		var ev struct {
			Type string `json:"type"`
			Data struct {
				Message struct {
					Content struct {
						Text string `json:"text"`
					} `json:"content"`
				} `json:"message"`
			} `json:"data"`
		}
		_ = json.Unmarshal(body, &ev)
		w.Header().Set("Content-Type", "application/json")
		if ev.Type != "message.received" {
			w.Write([]byte("{}"))
			return
		}
		json.NewEncoder(w).Encode(map[string]any{
			"reply": map[string]any{"type": "text", "text": "You said: " + ev.Data.Message.Content.Text},
		})
	})
	http.ListenAndServe(":3000", nil)
}