Webhook

{
  "id": "evt_1234567890",
  "timestamp": "2025-01-17T12:34:56.789Z",
  "type": "v1.repo.commit.created",
  "data": {
    // Event-specific data
  }
}

{
  "id": "evt_2KtGQeeJhtF5qQ",
  "timestamp": "2025-01-17T08:23:15.123Z",
  "type": "v1.repo.commit.created",
  "data": {
    "repository_id": "dv.repo.12345678-1234-1234-1234-123456789abc",
    "repository_name": "my-project",
    "repository_owner_id": "Google_12345678901234567890",
    "commit_id": "dv.commit.123456",
    "commit_url": "https://app.diversion.dev/r/my-project/commit/dv.commit.123456",
    "correlation_id": "abc123-def456-ghi789",
    "message": "Add new feature",
    "commit_time": "2025-01-17T08:23:14.567Z",
    "branch_id": "dv.branch.42",
    "branch_name": "feature-branch",
    "branch_url": "https://app.diversion.dev/r/my-project/branch/dv.branch.42",
    "author": {
        "id": "Google_12345678901234567890",
        "name": "John Doe",
        "email": "john.doe@example.com",
        "full_name": "John Doe"
    },
    "parent_commits": [
        {
            "commit_id": "dv.commit.123455",
            "branch_id": "dv.branch.42"
        }
    ],
    "changes": {
        "deleted": [
            "del1.txt",
            "del2.txt",
            "del3.txt"
        ],
        "has_more_deleted": false,
        "modified": [
            "mod1.txt",
            "mod2.txt"
        ],
        "has_more_modified": false,
        "new": [
            "new1.txt"
        ],
        "has_more_new": false
    }
  }
}

{
  "id": "evt_2KtGQeeJhtF5qQ",
  "timestamp": "2025-01-17T08:23:15.123Z",
  "type": "v1.repo.review.created",
  "data": {
    "repository_id": "dv.repo.12345678-1234-1234-1234-123456789abc",
    "repository_name": "my-project",
    "repository_owner_id": "Google_12345678901234567890",
    "review_id": "dv.review.98765",
    "review_url": "https://app.diversion.dev/r/my-project/review/dv.review.98765",
    "title": "Add authentication feature",
    "description": "This review adds OAuth2 authentication to the API",
    "status": "open",
    "created_unix": 1737098594,
    "draft_commit_id": "dv.commit.123456",
    "base_branch_id": "dv.branch.1",
    "base_branch_name": "master",
    "compare_branch_id": "dv.branch.42",
    "compare_branch_name": "feature-auth",
    "author": {
    "id": "Google_12345678901234567890",
    "name": "johndoe",
    "full_name": "John Doe",
    "email": "john.doe@example.com"
    },
    "reviewers": [
        {
          "id": "Google_98765432109876543210",
          "name": "janedoe",
          "full_name": "Jane Doe",
          "email": "jane.doe@example.com",
          "status": "requested"
        },
        {
          "id": "Google_11111111111111111111",
          "name": "bobsmith",
          "full_name": "Bob Smith",
          "email": "bob.smith@example.com",
          "status": "approved"
        }
    ],
    "correlation_id": "abc123-def456-ghi789"
  }
}

{
  "id": "evt_3MuHRffKiuG6rR",
  "timestamp": "2025-01-17T09:45:30.456Z",
  "type": "v1.repo.review.merged",
  "data": {
    "repository_id": "dv.repo.12345678-1234-1234-1234-123456789abc",
    "repository_name": "my-project",
    "repository_owner_id": "Google_12345678901234567890",
    "review_id": "dv.review.98765",
    "review_url": "https://app.diversion.dev/r/my-project/review/dv.review.98765",
    "title": "Add authentication feature",
    "description": "This review adds OAuth2 authentication to the API",
    "status": "merged",
    "created_unix": 1737098594,
    "updated_unix": 1737103530,
    "merge_commit_id": "dv.commit.123457",
    "draft_commit_id": "dv.commit.123456",
    "base_branch_id": "dv.branch.1",
    "base_branch_name": "master",
    "compare_branch_id": "dv.branch.42",
    "compare_branch_name": "feature-auth",
    "author": {
        "id": "Google_12345678901234567890",
        "name": "johndoe",
        "full_name": "John Doe",
        "email": "john.doe@example.com"
    },
    "reviewers": [
        {
          "id": "Google_98765432109876543210",
          "name": "janedoe",
          "full_name": "Jane Doe",
          "email": "jane.doe@example.com",
          "status": "approved"
        },
        {
          "id": "Google_11111111111111111111",
          "name": "bobsmith",
          "full_name": "Bob Smith",
          "email": "bob.smith@example.com",
          "status": "approved"
        }
    ],
    "correlation_id": "xyz789-abc123-def456"
  }
}

import base64
import hashlib
import hmac

def verify_webhook_signature(webhook_id, webhook_timestamp, sig_header, secret, payload_body):
    # Svix signature format: v1,base64signature
    if not sig_header.startswith('v1,'):
        print(f"Invalid signature format: {sig_header}")
        return False
    
    # Extract the signature part after v1,
    v1_signature = sig_header[3:]  # Skip "v1,"
    
    # Use raw hex format directly as the signing key
    try:
        # Svix uses the literal hex string as UTF-8 bytes for signing
        signing_key = secret.encode('utf-8')
    except Exception as e:
        print(f"Failed to encode secret: {e}")
        return False
    
    # Construct the signed content according to Svix docs
    # Format: {id}.{timestamp}.{payload}
    signed_content = f"{webhook_id}.{webhook_timestamp}.{payload_body.decode('utf-8')}"
    
    # Compute HMAC-SHA256
    computed_hmac = hmac.new(
        signing_key,  # Use the hex string encoded as UTF-8 bytes
        signed_content.encode('utf-8'),
        hashlib.sha256  
    ).digest()
    
    # Base64 encode the result
    expected_sig = base64.b64encode(computed_hmac).decode('utf-8')
    
    # Compare signatures
    is_valid = hmac.compare_digest(expected_sig, v1_signature)
    
    if is_valid:
        print("Svix signature verified successfully")
    else:
        print(f"Signature verification failed. Expected: {expected_sig}, Got: {v1_signature}")
    
    return is_valid