الويب هوك

{
  "id": "evt_Vd9sX2…",
  "type": "participant.joined",
  "created_at": "2026-09-17T09:20:11.482Z",
  "data": {
    "room": { "id": "5f0c2b8e-…", "code": "k7pq-3mzt-9xwe", "name": "Onboarding call" },
    "participant": { "identity": "api_Qm9v….k2d9x0aa", "name": "Omar", "role": "participant" },
    "occurred_at": "2026-09-17T09:20:11.000Z"
  }
}

import { verifyWebhook } from "@deewan/sdk";

export async function POST(request: Request) {
  const raw = await request.text(); // the raw body, not parsed JSON
  try {
    const event = await verifyWebhook(raw, request.headers.get("deewan-signature"), process.env.DEEWAN_WEBHOOK_SECRET!);
    if (event.type === "room.finished") await markSessionComplete(event.data);
    return new Response(null, { status: 204 });
  } catch {
    return new Response("invalid signature", { status: 400 });
  }
}

import hmac, hashlib, time

def verify(raw_body: bytes, header: str, secret: str, tolerance=300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t = int(parts["t"])
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts["v1"])