d7f9bde5e9
POST /api/ingest/karakeep accepts Karakeep webhook payloads. HMAC signature on the raw body captured by express.json's verify hook. Mounted on app before mountApi so it bypasses agentOrOwner — the shared secret IS the auth. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
35 lines
1.3 KiB
JavaScript
35 lines
1.3 KiB
JavaScript
import { Router } from 'express';
|
|
import crypto from 'node:crypto';
|
|
import * as queue from '../../jobs/queue.js';
|
|
import { asyncWrap } from '../errors.js';
|
|
|
|
function verify(rawBody, headerSig) {
|
|
const secret = process.env.KARAKEEP_WEBHOOK_SECRET || '';
|
|
if (!headerSig || !secret || !rawBody) return false;
|
|
const expected = 'sha256=' +
|
|
crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
|
|
try { return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(headerSig)); }
|
|
catch { return false; }
|
|
}
|
|
|
|
export const router = Router();
|
|
|
|
router.post('/karakeep', asyncWrap(async (req, res) => {
|
|
const sig = req.headers['x-karakeep-signature'];
|
|
if (!verify(req.rawBody, sig)) {
|
|
return res.status(401).json({ error: { code: 'unauthorized', message: 'bad signature' } });
|
|
}
|
|
const payload = req.body;
|
|
if (payload.event !== 'bookmark.created') return res.status(202).json({ skipped: true });
|
|
const space_id = process.env.KARAKEEP_DEFAULT_SPACE_ID;
|
|
if (!space_id) {
|
|
return res.status(503).json({
|
|
error: { code: 'unconfigured', message: 'KARAKEEP_DEFAULT_SPACE_ID not set' }
|
|
});
|
|
}
|
|
const job_id = await queue.enqueue('ingest.karakeep', {
|
|
bookmark_id: payload.bookmark_id, space_id
|
|
});
|
|
res.status(202).json({ job_id });
|
|
}));
|