Receive webhooks on Cloudflare Workers

export interface Env {
  GOBARE_API: string;
  GOBARE_TOKEN: string;
  GOBARE_WEBHOOK_SECRET: string;
  SEEN: KVNamespace;
  RESULTS: KVNamespace;
}

interface GobareEvent {
  object: "event";
  type: string;
  created_at: number;
  data: { session_id: string; turn_id?: string | null; required_action?: { type: string } };
}

const encoder = new TextEncoder();

function hexToBytes(hex: string): Uint8Array<ArrayBuffer> | null {
  if (!/^[0-9a-f]+$/i.test(hex) || hex.length % 2 !== 0) return null;
  const out = new Uint8Array(new ArrayBuffer(hex.length / 2));
  for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
  return out;
}

export async function verify(secret: string, timestamp: string, body: string, presented: string): Promise<boolean> {
  const signature = hexToBytes(presented);
  if (!signature) return false;
  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
  return crypto.subtle.verify("HMAC", key, signature, encoder.encode(`${timestamp}.${body}`));
}

async function api(env: Env, path: string): Promise<any> {
  for (let attempt = 1; ; attempt++) {
    const res = await fetch(`${env.GOBARE_API}${path}`, { headers: { authorization: `Bearer ${env.GOBARE_TOKEN}` } }).catch(() => null);
    if (res && res.status < 500) {
      if (!res.ok) throw new Error(`${path} answered ${res.status}: ${await res.text()}`);
      return res.json();
    }
    if (attempt === 4) throw new Error(`${path}: ${res ? res.status : "network error"} after ${attempt} attempts`);
    await new Promise((r) => setTimeout(r, attempt * 1000));
  }
}

async function handle(event: GobareEvent, env: Env): Promise<void> {
  const { session_id, turn_id } = event.data;
  if (event.type === "turn.completed" || event.type === "turn.failed") {
    const session = await api(env, `/v1/sessions/${session_id}`);
    // `turn_id` is null when the event had no turn record; the latest turn is the one it means.
    const turn = turn_id
      ? await api(env, `/v1/sessions/${session_id}/turns/${turn_id}`)
      : (await api(env, `/v1/sessions/${session_id}/turns?limit=1`)).data[0];
    const items = await api(env, `/v1/sessions/${session_id}/items?limit=20`);
    const reply = items.data.find((item: any) => item.type === "message" && item.role === "assistant");
    await env.RESULTS.put(session_id, JSON.stringify({
      metadata: session.metadata,
      status: turn?.status ?? null,
      error: turn?.error ?? null,
      reply: reply?.content ?? null,
    }));
  }
}

export default {
  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
    if (request.method !== "POST") return new Response("method not allowed", { status: 405 });

    const body = await request.text();
    const timestamp = request.headers.get("x-gobare-timestamp") ?? "";
    const signature = request.headers.get("x-gobare-signature") ?? "";

    if (!(await verify(env.GOBARE_WEBHOOK_SECRET, timestamp, body, signature))) {
      return new Response("bad signature", { status: 401 });
    }
    if (Math.abs(Date.now() - Number(timestamp)) > 5 * 60_000) {
      return new Response("stale delivery", { status: 400 });
    }

    const event = JSON.parse(body) as GobareEvent;
    const key = `${event.data.session_id}:${event.type}:${event.created_at}`;
    if (await env.SEEN.get(key)) return new Response("duplicate", { status: 200 });
    await env.SEEN.put(key, "1", { expirationTtl: 60 * 60 * 24 });

    ctx.waitUntil(handle(event, env));
    return new Response("ok");
  },
};

name = "gobare-hooks"
main = "worker.ts"
compatibility_date = "2026-09-01"

kv_namespaces = [
  { binding = "SEEN", id = "<your SEEN namespace id>" },
  { binding = "RESULTS", id = "<your RESULTS namespace id>" },
]

[vars]
GOBARE_API = "https://api.gobare.dev"

npx wrangler secret put GOBARE_TOKEN
npx wrangler secret put GOBARE_WEBHOOK_SECRET
npx wrangler deploy

curl -s -X POST $GOBARE_API/v1/webhooks \
  -H "Authorization: Bearer $GOBARE_TOKEN" -H 'content-type: application/json' \
  -d '{"url":"https://gobare-hooks.your-account.workers.dev","events":["turn.completed","turn.failed"]}'