Webhook-Trigger: Workflows von außen starten

BASE="https://browserberg.com"
AUTH="Authorization: Bearer $BROWSERBERG_API_KEY"
JSON="Content-Type: application/json"

WFID=$(curl -s -X POST "$BASE/v1/workflows" -H "$AUTH" -H "$JSON" -d '{
  "title": "Webhook walkthrough",
  "blocks": [ { "blockType": "navigation", "label": "Open_page", "url": "https://example.com" } ]
}' | python3 -c 'import json,sys; print(json.load(sys.stdin)["workflow"]["workflowId"])')

# The secret comes back exactly once, at creation. Store it; it cannot be read
# back, only rotated.
CREATED=$(curl -s -X POST "$BASE/v1/workflows/$WFID/triggers" -H "$AUTH" -H "$JSON" \
  -d '{ "kind": "webhook", "name": "ERP delivery", "session": { "ttlSeconds": 300 } }')
SECRET=$(echo "$CREATED" | python3 -c 'import json,sys; print(json.load(sys.stdin)["secret"])')
TID=$(echo "$CREATED" | python3 -c 'import json,sys; print(json.load(sys.stdin)["trigger"]["id"])')

# Sign a delivery: HMAC-SHA256 over deliveryId.timestamp.rawBody -- the raw
# bytes you send, never a re-serialisation.
BODY='{"inputs":{}}'
DELIVERY="delivery-$(date +%s)"
TS=$(date +%s)
SIG=$(python3 -c "import hmac, hashlib, sys
delivery, ts, body, secret = sys.argv[1:5]
print(hmac.new(secret.encode(), f'{delivery}.{ts}.{body}'.encode(), hashlib.sha256).hexdigest())" \
  "$DELIVERY" "$TS" "$BODY" "$SECRET")

curl -s -X POST "$BASE/v1/trigger-hooks/$TID" -H "$JSON" \
  -H "x-browserberg-delivery: $DELIVERY" \
  -H "x-browserberg-timestamp: $TS" \
  -H "x-browserberg-signature: v1=$SIG" \
  -d "$BODY" \
  | python3 -c 'import json,sys; f = json.load(sys.stdin)["firing"]; print(json.dumps({
      "outcome": f["outcome"]}, indent=2))'

curl -s -X DELETE "$BASE/v1/triggers/$TID" -H "$AUTH" > /dev/null

{
  "outcome": "refused"
}