Webhooks

{
  "id": "evt_cmsnrowjd0000zuvyfxa9qh5w",
  "event": "ao.matched",
  "createdAt": "2026-08-10T14:32:11.104Z",
  "organizationId": "cmqh97bhf0000m1qdhadgvv23",
  "data": {
    "tender": {
      "uuid": "ctnyv8ruel8cr28l0sb0aky3",
      "kind": "AO",
      "reference": "15/2026",
      "title": "Travaux d'élargissement de la route provinciale 3406"
    },
    "match": { "id": "51", "adequacyPct": 78, "riskLevel": "LOW" }
  }
}

{
  "id": "evt_…", "event": "ao.deadline_soon", "createdAt": "…", "organizationId": "…",
  "data": {
    "tender": {
      "uuid": "ctnyv8ruel8cr28l0sb0aky3", "kind": "AO", "reference": "15/2026",
      "title": "Travaux d'élargissement…",
      "submissionDeadline": "2026-08-13T09:00:00.000Z"
    },
    "hoursRemaining": 66
  }
}

{
  "id": "evt_…", "event": "decompte.paid", "createdAt": "…", "organizationId": "…",
  "data": {
    "marche": { "uuid": "aaf24993-deec-4910-810b-bc15298c9e4e", "numero": "57/2025/BAT" },
    "paiement": {
      "uuid": "0198f2…", "montantRecu": 412350.75,
      "referenceVirement": "VIR-2026-0881", "payeLe": "2026-08-09"
    }
  }
}

{
  "id": "evt_…", "event": "adjudication.published", "createdAt": "…", "organizationId": "…",
  "data": {
    "tender": { "uuid": "…", "kind": "AO", "reference": "15/2026", "title": "…" },
    "adjudication": { "uuid": "0198f2…", "date": "2026-08-05", "bidCount": 7, "isCanceled": false }
  }
}

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.OGERANT_WEBHOOK_SECRET;

// `express.raw` : on a besoin du corps BRUT, pas d'un objet déjà parsé.
app.post("/ogerant", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("X-Ogerant-Signature") ?? "";
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2)));
  const t = Number(parts.t);
  const raw = req.body.toString("utf8");

  // 1. Fenêtre de tolérance : une requête capturée ne doit pas être rejouable.
  if (!Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > 300) {
    return res.status(400).send("horodatage hors fenêtre");
  }

  // 2. Comparaison en temps constant.
  const expected = crypto.createHmac("sha256", SECRET).update(`${t}.${raw}`).digest("hex");
  const ok =
    parts.v1 &&
    expected.length === parts.v1.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
  if (!ok) return res.status(400).send("signature invalide");

  // 3. Déduplication : un rejeu porte le MÊME X-Ogerant-Delivery.
  const event = JSON.parse(raw);
  if (alreadyHandled(req.get("X-Ogerant-Delivery"))) return res.sendStatus(200);

  // 4. Répondez vite (2xx sous 5 s), traitez en arrière-plan.
  enqueue(event);
  res.sendStatus(200);
});

<?php
$secret = getenv('OGERANT_WEBHOOK_SECRET');
$raw    = file_get_contents('php://input');           // le corps BRUT
$header = $_SERVER['HTTP_X_OGERANT_SIGNATURE'] ?? '';

$parts = [];
foreach (explode(',', $header) as $kv) {
    [$k, $v] = array_pad(explode('=', $kv, 2), 2, null);
    $parts[$k] = $v;
}
$t = isset($parts['t']) ? (int) $parts['t'] : 0;

// 1. Fenêtre de tolérance (5 minutes).
if ($t === 0 || abs(time() - $t) > 300) {
    http_response_code(400);
    exit('horodatage hors fenêtre');
}

// 2. Comparaison en temps constant.
$expected = hash_hmac('sha256', $t . '.' . $raw, $secret);
if (empty($parts['v1']) || !hash_equals($expected, $parts['v1'])) {
    http_response_code(400);
    exit('signature invalide');
}

// 3. Déduplication sur l'identifiant de livraison.
$deliveryId = $_SERVER['HTTP_X_OGERANT_DELIVERY'] ?? '';
if (dejaTraite($deliveryId)) { http_response_code(200); exit; }

// 4. Répondez vite, traitez ensuite.
$event = json_decode($raw, true);
enfiler($event);
http_response_code(200);