35 lines
688 B
Go
35 lines
688 B
Go
package middleware
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
|
|
"github.com/gofiber/fiber/v2"
|
|
)
|
|
|
|
func AleaWebhookMiddleware(secretKey string) fiber.Handler {
|
|
return func(c *fiber.Ctx) error {
|
|
// Verify IP comes from Alea's allowed IPs
|
|
// OR verify a signature header
|
|
|
|
// Example signature verification:
|
|
receivedSig := c.Get("X-Alea-Signature")
|
|
body := c.Body()
|
|
|
|
h := hmac.New(sha256.New, []byte(secretKey))
|
|
h.Write(body)
|
|
expectedSig := hex.EncodeToString(h.Sum(nil))
|
|
|
|
if receivedSig != expectedSig {
|
|
return c.Status(fiber.StatusForbidden).JSON(fiber.Map{
|
|
"error": "invalid signature",
|
|
})
|
|
}
|
|
|
|
return c.Next()
|
|
}
|
|
}
|
|
|
|
// Then update your route:
|