Webhooks

export default {
  async fetch(req: Request, env: { BELLHOP_WEBHOOK_SECRET: string }) {
    const body = await req.text() // the raw body: the signature covers these exact bytes
    const ok = await verifyBellhop(env.BELLHOP_WEBHOOK_SECRET, req.headers.get("Bellhop-Signature"), body)
    if (!ok) return new Response("Bad signature", { status: 401 })

    const event = JSON.parse(body)
    if (await seen(event.id)) return new Response(null, { status: 204 })
    if (event.type === "issue.opened") await triage(event.issue, event.metadata ?? [])
    return new Response(null, { status: 204 })
  },
}

{
  "actor": { "type": "member", "id": "085329df-a2d5-42bf-a4ad-a1b15c742067", "name": "ryan", "avatar_url": null, "role": "owner", "tier": null },
  "issue": {
    "id": "d667e97e-8996-4602-b6b2-993e4dd2b4b0",
    "number": 80,
    "title": "Crash on startup: config.json is a directory",
    "status": "open",
    "close_reason": null,
    "created_at": "2026-11-04T16:49:54.075Z",
    "updated_at": "2026-11-04T16:49:54.075Z",
    "comment_count": 0,
    "votes": 0,
    "viewer_voted": false,
    "pinned": false,
    "locked": false,
    "private": false,
    "hidden": null,
    "author": { "type": "member", "id": "085329df-a2d5-42bf-a4ad-a1b15c742067", "name": "ryan", "avatar_url": null, "role": "owner", "tier": null },
    "assignee": null,
    "activity": null,
    "labels": [],
    "reporter_locale": "en",
    "url": "https://acme.blhp.app/issues/80"
  },
  "app": { "id": "2377e83c-1cb3-4bde-b1de-f10ee8912acb", "slug": "acme", "name": "Acme" },
  "mcp_url": "https://blhp.app/mcp",
  "type": "issue.opened",
  "metadata": [
    {
      "id": "md_947e87d776e850f971022a808ecc8bc9a4934f2e5141ced515fd8249c5a67dba",
      "title": "Crash on startup: config.json is a directory",
      "message": "EISDIR: illegal operation on a directory, read\n    at loadConfig (config.ts:88)",
      "source": { "name": "Acme Desktop", "version": "2.4.1" },
      "system": { "OS": "macOS 15.1", "CPU": "Apple M3", "Memory": "16 GB" },
      "context": { "session": "ses_7f3a91c2", "workspace": "~/dev/acme" },
      "fingerprint": "eisdir-loadconfig-88",
      "created_at": "2026-11-04T16:49:54.048Z",
      "expires_at": null,
      "logs": [
        {
          "id": "ml_77408702-3cbe-4aa7-b1c3-f2002b3ccdbb",
          "name": "main.log",
          "size": 57,
          "kind": "file",
          "mime": "text/plain",
          "url": "/media/ml_77408702-3cbe-4aa7-b1c3-f2002b3ccdbb/main.log?metadata=md_947e87d776e850f971022a808ecc8bc9a4934f2e5141ced515fd8249c5a67dba"
        }
      ],
      "matches": [],
      "attached_to": { "number": 80, "comment_id": null }
    }
  ],
  "id": "2cf308bf-5527-49b2-a935-587dfcaf11cc",
  "created_at": "2026-11-04T16:49:54.083Z"
}

export async function verifyBellhop(secret: string, header: string | null, body: string, toleranceSeconds = 300) {
  const parts = new Map((header ?? "").split(",").map((p) => p.split("=", 2) as [string, string]))
  const t = Number(parts.get("t")), v1 = parts.get("v1") ?? ""
  if (!Number.isInteger(t) || Math.abs(Date.now() / 1000 - t) > toleranceSeconds || !/^[0-9a-f]{64}$/.test(v1)) return false
  const enc = new TextEncoder()
  const key = await crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"])
  const signature = Uint8Array.from(v1.match(/../g)!, (h) => parseInt(h, 16))
  return crypto.subtle.verify("HMAC", key, signature, enc.encode(`${t}.${body}`))
}

import hashlib
import hmac
import time


def verify_bellhop(secret: str, header: str, body: bytes, tolerance: int = 300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    try:
        t = int(parts["t"])
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), str(t).encode() + b"." + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", ""))