Run events webhooks

{
  "events": [
    {
      "data": {
        "environmentId": "p2f7h4s9j1d6l3g8a5q0w2ezoenv",
        "environmentName": "Staging",
        "flowId": "m3c8v1q6z9x2k5w7t0r4b8ndowor",
        "git": {
          "branch": "main",
          "commitMessage": "Add saved cards to checkout",
          "commitSha": "4f2c9a1e7b3d5f8a0c6e2b4d9f1a3c5e7b9d0f2a",
          "commitUrl": "https://github.com/acme/web/commit/4f2c9a1e7b3d5f8a0c6e2b4d9f1a3c5e7b9d0f2a"
        },
        "name": "Checkout with a saved card",
        "runId": "k7d2wq9m4x8b1n6t3r5y0hzposui",
        "statuses": [
          { "status": "queued", "timestamp": "2026-11-04T17:02:11.204Z" },
          { "status": "running", "timestamp": "2026-11-04T17:02:15.870Z" },
          { "status": "failed", "timestamp": "2026-11-04T17:09:42.031Z" }
        ],
        "triggerId": "t5n1b8x3c6v9m2k7j4h0g1fsogtr",
        "triggerName": "Deploys to staging",
        "url": "https://app.qawolf.com/acme/runs/r9w4e1q7t2y8u3i6o5p0a3sdorun"
      },
      "type": "flow.status-changed",
      "version": 1
    },
    {
      "data": {
        "environmentId": "p2f7h4s9j1d6l3g8a5q0w2ezoenv",
        "environmentName": "Staging",
        "git": {
          "branch": "main",
          "commitMessage": "Add saved cards to checkout",
          "commitSha": "4f2c9a1e7b3d5f8a0c6e2b4d9f1a3c5e7b9d0f2a",
          "commitUrl": "https://github.com/acme/web/commit/4f2c9a1e7b3d5f8a0c6e2b4d9f1a3c5e7b9d0f2a"
        },
        "runId": "k7d2wq9m4x8b1n6t3r5y0hzposui",
        "statuses": [
          { "status": "queued", "timestamp": "2026-11-04T17:02:10.958Z" },
          { "status": "running", "timestamp": "2026-11-04T17:02:15.402Z" },
          { "status": "failed", "timestamp": "2026-11-04T17:10:05.517Z" }
        ],
        "triggerId": "t5n1b8x3c6v9m2k7j4h0g1fsogtr",
        "triggerName": "Deploys to staging",
        "url": "https://app.qawolf.com/acme/environments/p2f7h4s9j1d6l3g8a5q0w2ezoenv/runs/k7d2wq9m4x8b1n6t3r5y0hzposui"
      },
      "type": "run.status-changed",
      "version": 1
    }
  ]
}

import express from "express";
import { Webhook } from "standardwebhooks";

const webhook = new Webhook(process.env.QAWOLF_WEBHOOK_SECRET);
const app = express();

app.post(
  "/qawolf/run-events",
  express.raw({ type: "application/json", limit: "1mb" }),
  async (req, res) => {
    let request;
    try {
      request = webhook.verify(req.body, req.headers);
    } catch {
      return res.sendStatus(401);
    }
    await storeEvents(request.events);
    res.sendStatus(204);
  },
);

import { createHmac, timingSafeEqual } from "node:crypto";

export function isSignedByQaWolf({ body, headers, secret }) {
  const id = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  const signatures = headers["webhook-signature"];
  if (!id || !timestamp || !signatures) return false;

  const sentAt = Number(timestamp);
  const now = Math.floor(Date.now() / 1000);
  if (!Number.isInteger(sentAt) || Math.abs(now - sentAt) > 5 * 60) {
    return false;
  }

  const key = Buffer.from(secret.slice("whsec_".length), "base64");
  const expected = createHmac("sha256", key)
    .update(`${id}.${timestamp}.${body}`)
    .digest();

  return signatures.split(" ").some((entry) => {
    const [version, signature] = entry.split(",");
    if (version !== "v1" || !signature) return false;
    const received = Buffer.from(signature, "base64");
    return (
      received.length === expected.length &&
      timingSafeEqual(received, expected)
    );
  });
}

const processed = new Map();
const knownTypes = new Set(["run.status-changed", "flow.status-changed"]);

function entityKey(event) {
  return event.type === "flow.status-changed"
    ? `flow:${event.data.runId}:${event.data.flowId}`
    : `run:${event.data.runId}`;
}

function positionOf(event) {
  const { statuses } = event.data;
  return [
    Date.parse(statuses[0].timestamp),
    Date.parse(statuses.at(-1).timestamp),
    statuses.length,
  ];
}

function isNewer(current, previous) {
  if (previous === undefined) return true;
  for (const [index, value] of current.entries()) {
    if (value !== previous[index]) return value > previous[index];
  }
  return false;
}

async function processEvents(events) {
  for (const event of events) {
    if (event.version !== 1 || !knownTypes.has(event.type)) continue;
    const key = entityKey(event);
    const current = positionOf(event);
    if (!isNewer(current, processed.get(key))) continue;

    const { status } = event.data.statuses.at(-1);
    if (event.type === "run.status-changed" && status === "failed") {
      await alertOnCall(event.data);
    }
    processed.set(key, current);
  }
}