Catch effective-date changes with webhooks

curl -X POST "https://ai-law-tracker.com/api/v1/webhooks" \
  -H "X-API-Key: alt_pro_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "target_url": "https://your-app.com/hooks/alt",
    "events": ["law.created", "law.updated"],
    "scope": "state",
    "jurisdiction": "california"
  }'

{
  "api_version": "v1",
  "data": {
    "id": "b3c4d5e6-0000-4444-8888-abcdef012345",
    "target_url": "https://your-app.com/hooks/alt",
    "events": ["law.created", "law.updated"],
    "scope": "state",
    "jurisdiction": "california",
    "active": true,
    "failure_count": 0,
    "created_at": "2026-08-06T12:00:00Z",
    "signing_secret": "whsec_… (shown once)"
  },
  "note": "Store signing_secret now — it is shown only once."
}

# list this key's webhooks
curl -s "https://ai-law-tracker.com/api/v1/webhooks" -H "X-API-Key: alt_pro_your_key_here"

# one subscription
curl -s "https://ai-law-tracker.com/api/v1/webhooks/b3c4d5e6-0000-4444-8888-abcdef012345" \
  -H "X-API-Key: alt_pro_your_key_here"

# unsubscribe
curl -X DELETE "https://ai-law-tracker.com/api/v1/webhooks/b3c4d5e6-0000-4444-8888-abcdef012345" \
  -H "X-API-Key: alt_pro_your_key_here"

{
  "event": "law.updated",
  "event_id": "a1b2c3d4-0000-4444-8888-abcdef012345",
  "delivery_id": "d4e5f6a7-0000-4444-8888-abcdef012345",
  "webhook_id": "b3c4d5e6-0000-4444-8888-abcdef012345",
  "change_kind": "update",
  "changed_fields": ["status"],
  "observed_at": "2026-08-06T09:15:44.512Z",
  "record": {
    "id": "5f9c2b0a-1e34-4d21-9a77-0c1b2d3e4f56",
    "scope": "state",
    "jurisdiction": { "slug": "california", "name": "California", "abbr": "CA" },
    "identifier": "SB 942",
    "title": "California AI Transparency Act",
    "status": "Signed — effective 2026-01-01",
    "official_url": "https://leginfo.legislature.ca.gov/…",
    "updated_at": "2026-08-06T09:15:44.512Z",
    "attribution": "Data by AI Law Tracker (CC BY 4.0) — https://ai-law-tracker.com"
  },
  "attribution": "Data by AI Law Tracker (CC BY 4.0) — https://ai-law-tracker.com"
}

const crypto = require('node:crypto');
const express = require('express');

const app = express();
const SECRET = process.env.ALT_WEBHOOK_SECRET;
const TOLERANCE_SEC = 300; // the sender's replay tolerance

// CRITICAL: keep the RAW bytes. Hashing a re-serialised object will not match.
app.post(
  '/hooks/alt',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const raw = req.body.toString('utf8');
    const ts = req.get('X-ALT-Timestamp');
    const received = String(req.get('X-ALT-Signature') || '')
      .replace(/^sha256=/, '')
      .trim();

    if (!received) return res.status(400).send('missing signature');

    // Replay guard: the timestamp is inside the signed content, so a captured
    // body cannot be re-signed under a fresh timestamp.
    const skew = Math.abs(Math.floor(Date.now() / 1000) - Number(ts));
    if (!Number.isFinite(skew) || skew > TOLERANCE_SEC) {
      return res.status(400).send('timestamp outside tolerance');
    }

    const expected = crypto
      .createHmac('sha256', SECRET)
      .update(`${ts}.${raw}`)          // signed_content
      .digest('hex');

    const a = Buffer.from(received, 'utf8');
    const b = Buffer.from(expected, 'utf8');
    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.status(400).send('signature mismatch');
    }

    // Verified. Ack FAST, then work asynchronously.
    const payload = JSON.parse(raw);
    res.status(200).end();
    void handleChange(req.get('X-ALT-Delivery'), payload);
  }
);

async function handleChange(deliveryId, payload) {
  // See step 4 — de-duplicate on deliveryId / payload.event_id first.
  if (await alreadyProcessed(deliveryId)) return;

  const fields = payload.changed_fields || [];
  const touchesDates = ['status', 'in_force', 'record_date', 'summary'].some((f) =>
    fields.includes(f)
  );
  if (payload.event === 'law.created' || touchesDates) {
    await notifyComplianceTeam(payload.record, fields);
  }
  await markProcessed(deliveryId);
}

import hashlib
import hmac
import os
import time

from fastapi import FastAPI, Header, HTTPException, Request

app = FastAPI()
SECRET = os.environ["ALT_WEBHOOK_SECRET"].encode()
TOLERANCE_SEC = 300


@app.post("/hooks/alt")
async def alt_webhook(
    request: Request,
    x_alt_signature: str = Header(default=""),
    x_alt_timestamp: str = Header(default=""),
    x_alt_delivery: str = Header(default=""),
):
    raw = await request.body()  # RAW bytes — never a re-serialised dict

    received = x_alt_signature.removeprefix("sha256=").strip()
    if not received:
        raise HTTPException(400, "missing signature")

    try:
        skew = abs(int(time.time()) - int(x_alt_timestamp))
    except ValueError:
        raise HTTPException(400, "missing/invalid timestamp")
    if skew > TOLERANCE_SEC:
        raise HTTPException(400, "timestamp outside tolerance")

    signed_content = f"{x_alt_timestamp}.".encode() + raw
    expected = hmac.new(SECRET, signed_content, hashlib.sha256).hexdigest()

    if not hmac.compare_digest(received, expected):
        raise HTTPException(400, "signature mismatch")

    payload = await request.json()
    if await already_processed(x_alt_delivery):
        return {"ok": True, "duplicate": True}

    fields = payload.get("changed_fields") or []
    if payload["event"] == "law.created" or {"status", "in_force", "record_date", "summary"} & set(fields):
        await notify_compliance_team(payload["record"], fields)

    await mark_processed(x_alt_delivery)
    return {"ok": True}