Webhooks

import { Mesa } from "@mesadev/sdk";

const mesa = new Mesa({ apiKey: process.env.MESA_API_KEY });

const target = await mesa.webhookTargets.create({
  org: "acme",
  name: "My App - Prod", // Optional human-readable label.
  url: "https://acme.dev/webhooks/mesa",
  events: ["push", "change.created", "change.evolved"],
  // Omit `repo_ids` for an org-wide target.
  repo_ids: ["repo_abc123"],
});

// The secret is returned once on create. Save it to verify signatures later.
console.log(target.secret);

from mesa_sdk import Mesa

mesa = Mesa()

target = await mesa.webhook_targets.create(
    org="acme",
    name="My App - Prod",  # Optional human-readable label.
    url="https://acme.dev/webhooks/mesa",
    events=["push", "change.created", "change.evolved"],
    # Omit `repo_ids` for an org-wide target.
    repo_ids=["repo_abc123"],
)

# The secret is returned once on create. Save it to verify signatures later.
print(target.secret)

const { webhook_targets, next_cursor, has_more } = await mesa.webhookTargets.list({
  org: "acme",
  limit: 50,
  // cursor: previousResponse.next_cursor,
});

targets = await mesa.webhook_targets.list(
    org="acme",
    limit=50,
    # cursor=previous_response.next_cursor,
)

webhook_targets = targets.webhook_targets
next_cursor = targets.next_cursor
has_more = targets.has_more

await mesa.webhookTargets.update({
  org: "acme",
  webhookTargetId: "wh_123",
  url: "https://acme.dev/webhooks/mesa-v2",
  events: ["push"], // replaces all previously subscribed events
  repo_ids: null,    // clear the filter -> org-wide
});

await mesa.webhook_targets.update(
    org="acme",
    webhook_target_id="wh_123",
    url="https://acme.dev/webhooks/mesa-v2",
    events=["push"],  # replaces all previously subscribed events
)

# clear the filter -> org-wide
await mesa.webhook_targets.clear_repo_filter(
    org="acme",
    webhook_target_id="wh_123",
)

await mesa.webhookTargets.delete({
  org: "acme",
  webhookTargetId: "wh_123",
});

await mesa.webhook_targets.delete(
    org="acme",
    webhook_target_id="wh_123",
)

import { createHmac, timingSafeEqual } from "crypto";

const signatureHeader = request.headers.get("x-mesa-signature");
if (!signatureHeader) throw new Error("Missing signature header");

const parts = Object.fromEntries(
  signatureHeader.split(",").map((part) => part.trim().split("="))
);

const timestamp = Number(parts.t);
const signature = parts.sha256;
const body = await request.text();

const expected = createHmac("sha256", process.env.WEBHOOK_SECRET)
  .update(`${timestamp}.${body}`)
  .digest("hex");

const valid = timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
if (!valid) throw new Error("Invalid signature");

import hashlib
import hmac
import os

signature_header = request.headers.get("x-mesa-signature")
if signature_header is None:
    raise ValueError("Missing signature header")

parts = dict(part.strip().split("=", 1) for part in signature_header.split(","))
timestamp = parts["t"]
signature = parts["sha256"]
body = await request.body()

expected = hmac.new(
    os.environ["WEBHOOK_SECRET"].encode(),
    f"{timestamp}.".encode() + body,
    hashlib.sha256,
).hexdigest()

if not hmac.compare_digest(signature, expected):
    raise ValueError("Invalid signature")