Webhooks

{
  "event": "probe.status_changed",
  "probe_id": "clx1abc2def3ghi4jkl5",
  "probe_name": "Production PBX Health",
  "project_id": "clx9mno6pqr7stu8vwx0",
  "project_name": "Production Environment",
  "previous_status": "HEALTHY",
  "current_status": "DEGRADED",
  "timestamp": "2026-01-15T10:30:00.000Z",
  "execution_id": "clx2yz1abc2def3ghi4",
  "metrics": {
    "mos": 3.2,
    "jitter_ms": 45.3,
    "packet_loss_pct": 2.1,
    "rtt_ms": 180,
    "setup_time_ms": 2100
  },
  "thresholds_breached": [
    {
      "metric": "mos",
      "value": 3.2,
      "warning_threshold": 3.5,
      "critical_threshold": 2.5,
      "level": "warning"
    }
  ]
}

const crypto = require('crypto');

function verifyWebhook(req, webhookSecret) {
  const signature = req.headers['x-callmeter-signature'];
  const timestamp = req.headers['x-callmeter-timestamp'];
  const body = req.rawBody; // raw request body as string

  // Replay prevention: reject requests older than 5 minutes
  const age = Date.now() - parseInt(timestamp, 10);
  if (age > 5 * 60 * 1000) {
    return false;
  }

  // Compute expected signature
  const signingString = `${timestamp}.${body}`;
  const expected = crypto
    .createHmac('sha256', webhookSecret)
    .update(signingString)
    .digest('hex');

  // Timing-safe comparison (CRITICAL: prevents timing attacks)
  const sig = `sha256=${expected}`;
  return crypto.timingSafeEqual(
    Buffer.from(sig),
    Buffer.from(signature)
  );
}

import hmac
import hashlib
import time

def verify_webhook(headers, body, webhook_secret):
    signature = headers.get('X-CallMeter-Signature')
    timestamp = headers.get('X-CallMeter-Timestamp')

    # Replay prevention
    age = int(time.time() * 1000) - int(timestamp)
    if age > 5 * 60 * 1000:
        return False

    # Compute expected signature
    signing_string = f"{timestamp}.{body}"
    expected = hmac.new(
        webhook_secret.encode(),
        signing_string.encode(),
        hashlib.sha256
    ).hexdigest()

    # Timing-safe comparison
    return hmac.compare_digest(
        f"sha256={expected}",
        signature
    )

// Middleware that receives CallMeter webhook and forwards to Slack
app.post('/callmeter-to-slack', verifyWebhookMiddleware, async (req, res) => {
  const { probe_name, previous_status, current_status, metrics, timestamp } = req.body;

  const color = current_status === 'HEALTHY' ? '#36a64f'
    : current_status === 'DEGRADED' ? '#daa520'
    : '#ff0000';

  await fetch(process.env.SLACK_WEBHOOK_URL, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      attachments: [{
        color,
        title: `Probe Alert: ${probe_name}`,
        text: `Status changed from ${previous_status} to ${current_status}`,
        fields: [
          { title: 'MOS', value: metrics.mos?.toFixed(1) || 'N/A', short: true },
          { title: 'Jitter', value: `${metrics.jitter_ms?.toFixed(0) || 'N/A'}ms`, short: true },
          { title: 'Packet Loss', value: `${metrics.packet_loss_pct?.toFixed(1) || 'N/A'}%`, short: true },
          { title: 'RTT', value: `${metrics.rtt_ms?.toFixed(0) || 'N/A'}ms`, short: true },
        ],
        ts: new Date(timestamp).getTime() / 1000,
      }],
    }),
  });

  res.sendStatus(200);
});

app.post('/callmeter-to-pagerduty', verifyWebhookMiddleware, async (req, res) => {
  const { probe_id, probe_name, current_status, metrics } = req.body;

  const action = current_status === 'HEALTHY' ? 'resolve' : 'trigger';
  const severity = current_status === 'UNHEALTHY' ? 'critical' : 'warning';

  await fetch('https://events.pagerduty.com/v2/enqueue', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      routing_key: process.env.PAGERDUTY_ROUTING_KEY,
      event_action: action,
      dedup_key: `callmeter-probe-${probe_id}`,
      payload: {
        summary: `CallMeter probe "${probe_name}" is ${current_status}`,
        severity,
        source: 'callmeter.io',
        custom_details: metrics,
      },
    }),
  });

  res.sendStatus(200);
});

app.post('/callmeter-to-teams', verifyWebhookMiddleware, async (req, res) => {
  const { probe_name, previous_status, current_status, metrics, timestamp } = req.body;

  const themeColor = current_status === 'HEALTHY' ? '36a64f'
    : current_status === 'DEGRADED' ? 'daa520'
    : 'ff0000';

  await fetch(process.env.TEAMS_WEBHOOK_URL, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      '@type': 'MessageCard',
      themeColor,
      summary: `Probe Alert: ${probe_name}`,
      sections: [{
        activityTitle: `Probe: ${probe_name}`,
        activitySubtitle: new Date(timestamp).toISOString(),
        facts: [
          { name: 'Previous Status', value: previous_status },
          { name: 'Current Status', value: current_status },
          { name: 'MOS', value: metrics.mos?.toFixed(1) || 'N/A' },
          { name: 'Jitter', value: `${metrics.jitter_ms?.toFixed(0) || 'N/A'}ms` },
          { name: 'Packet Loss', value: `${metrics.packet_loss_pct?.toFixed(1) || 'N/A'}%` },
          { name: 'RTT', value: `${metrics.rtt_ms?.toFixed(0) || 'N/A'}ms` },
        ],
      }],
    }),
  });

  res.sendStatus(200);
});