Documentation
¶
Overview ¶
Generated by codegen. Do not edit by hand. Package webhooks verifies the signature ZelfAI puts on every webhook delivery.
Index ¶
Constants ¶
const ( SignatureHeader = "Webhook-Signature" TimestampHeader = "Webhook-Timestamp" IDHeader = "Webhook-Id" // DefaultTolerance bounds how far a delivery's timestamp may sit from now // before it is treated as a replay. DefaultTolerance = 5 * time.Minute )
Variables ¶
var ErrVerification = errors.New("webhook verification failed")
ErrVerification is returned for every failed verification. Callers should answer a failed verification with 400 and never process the body.
Functions ¶
func Verify ¶
func Verify(payload []byte, signature string, secrets []string, opts Options) (map[string]any, error)
Verify checks a delivery against one or more signing secrets and returns the decoded payload.
payload must be the exact bytes received: re-encoding the JSON changes the bytes and the signature will not match.
A rotation switches at once: the API signs the next delivery with the new secret only and rejects the old one immediately. A list of secrets is accepted, so both can be held during a rollout.
Types ¶
type DownloadOptions ¶
type DownloadOptions struct {
HTTPClient *http.Client
// SkipChecksum turns off the SHA-256 check over the downloaded body.
SkipChecksum bool
}
DownloadOptions tunes Rows. The zero value uses http.DefaultClient and verifies the published checksum.
type Event ¶
type Event struct {
// Raw is the payload exactly as it arrived, including any field this SDK
// predates.
Raw map[string]any
ID string
Type EventType
SubscriptionID string
DeliveredAt time.Time
Livemode bool
Resource string
DeliveryMode string
ItemCount int
Files []File
Items []map[string]any
Statistics map[string]any
}
Event is a delivery whose signature has already been checked.
func (*Event) Rows ¶
func (e *Event) Rows(ctx context.Context, visit func(row map[string]any) error, opts DownloadOptions) error
Rows downloads the manifest files and calls visit for each decoded row.
Each DownloadURL is signed and expires, so fetch soon after delivery. Unless SkipChecksum is set, the published SHA-256 is recomputed over the body, and a mismatch or a missing digest stops the walk before any row is visited.
type EventType ¶
type EventType string
EventType is an event the API can deliver, one per `webhooks` declaration in the spec.
const ( // EventAIAnalysisCompleted Fires when an AI analysis run reaches a terminal state (COMPLETED or FAILED) EventAIAnalysisCompleted EventType = "ai_analysis.completed" // EventContentSnapshot Scheduled snapshot of the content set that a subscription matches EventContentSnapshot EventType = "content.snapshot" // EventCreatorSnapshot Scheduled snapshot of the creator set that a subscription matches EventCreatorSnapshot EventType = "creator.snapshot" // EventCreatorVettingCompleted Fires when a creator vetting analysis run reaches a terminal state... EventCreatorVettingCompleted EventType = "creator_vetting.completed" )
type File ¶
type File struct {
Format string `json:"format"`
ExpiresAt int64 `json:"expires_at"`
SHA256 string `json:"sha256"`
SizeBytes int64 `json:"size_bytes"`
ItemCount int `json:"item_count"`
DownloadURL string `json:"download_url"`
}
File is one downloadable snapshot file in a manifest delivery.
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler verifies a delivery once, then routes it to the listener for its type. It is framework agnostic: hand it the raw body and the signature header from whatever server is in front of it.
func NewHandler ¶
NewHandler builds a Handler for the given signing secrets. A rotation switches at once, so hold both only for as long as the rollout takes.
func (*Handler) Handle ¶
Handle verifies, then calls every listener registered for the event type. It returns before any listener runs if the signature, timestamp, or body does not check out.
Source Files