webhooksmith-actix 0.1.7

Actix-web integration for webhooksmith — verified webhook extractor for incoming webhooks
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

# webhooksmith-actix

[![crates.io](https://img.shields.io/crates/v/webhooksmith-actix.svg)](https://crates.io/crates/webhooksmith-actix)

Actix-web integration for [webhooksmith](https://crates.io/crates/webhooksmith).

Provides `VerifiedWebhook` and `TypedWebhook<T>` extractors that verify incoming webhook
HMAC-SHA256 signatures and reject forged, stale, or oversized requests.

## Usage

```toml
[dependencies]
webhooksmith-actix = "0.1"
actix-web = "4"
serde = { version = "1", features = ["derive"] }
```

```rust
use actix_web::{web, App, HttpServer, HttpResponse, Responder};
use webhooksmith_actix::{WebhookSecret, VerifiedWebhook, TypedWebhook};
use serde::Deserialize;

#[derive(Deserialize)]
struct OrderCreated { order_id: u64 }

async fn handle_raw(webhook: VerifiedWebhook) -> impl Responder {
    println!("event: {}, id: {:?}", webhook.event_type, webhook.event_id);
    HttpResponse::Ok().finish()
}

async fn handle_typed(webhook: TypedWebhook<OrderCreated>) -> impl Responder {
    println!("order: {}", webhook.payload.order_id);
    HttpResponse::Ok().finish()
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    HttpServer::new(|| {
        App::new()
            .app_data(WebhookSecret::new("your-signing-secret"))
            .route("/webhooks", web::post().to(handle_raw))
            .route("/orders", web::post().to(handle_typed))
    })
    .bind("0.0.0.0:8080")?
    .run()
    .await
}
```

## Rejection behaviour

| Condition | Status |
|-----------|--------|
| Missing `x-hooksmith-signature` | 401 |
| Missing `x-hooksmith-timestamp` | 400 |
| Invalid timestamp (non-integer) | 400 |
| Stale timestamp (> 300 s skew) | 401 |
| Signature mismatch | 401 |
| Body > 1 MB | 413 |
| Body is not valid JSON | 422 |

All error responses are JSON: `{"error": "..."}`.

## License

MIT OR Apache-2.0