Fraud Detection API — Integration Guide

import hmac, hashlib, os
from flask import Flask, request

def verify_signature(payload_bytes: bytes, header_sig: str, secret: str) -> bool:
    """Return True if the webhook signature is valid."""
    expected = hmac.new(
        secret.encode(),
        payload_bytes,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, header_sig)

app = Flask(__name__)

@app.route("/remorant-webhook", methods=["POST"])
def handle_webhook():
    ok = verify_signature(
        request.get_data(),                              # raw bytes — before JSON parsing
        request.headers.get("X-Remorant-Signature", ""),
        os.environ["REMORANT_WEBHOOK_SECRET"],
    )
    if not ok:
        return {"error": "Invalid signature"}, 401

    event = request.json
    if event["event_type"] == "transaction.fraud_detected":
        handle_fraud_alert(event["data"])
    elif event["event_type"] == "transaction.blocked":
        handle_blocked(event["data"])
    elif event["event_type"] == "drift.detected":
        notify_ops_team(event["data"])

    return {"received": True}, 200

import crypto from 'crypto';
import express from 'express';

function verifySignature(rawBody, headerSig, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  // timingSafeEqual prevents timing-based attacks
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(headerSig));
}

const app = express();

// Use express.raw() to preserve raw bytes for signature verification
app.post('/remorant-webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.headers['x-remorant-signature'] ?? '';
  if (!verifySignature(req.body, sig, process.env.REMORANT_WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = JSON.parse(req.body);
  switch (event.event_type) {
    case 'transaction.fraud_detected': handleFraudAlert(event.data); break;
    case 'transaction.blocked':        handleBlocked(event.data);    break;
    case 'drift.detected':             notifyOps(event.data);        break;
  }
  res.json({ received: true });
});