Data Wallet Overview

import crypto from "crypto";
import express from "express";

const app = express();
app.use(express.raw({ type: "application/json" }));

const webhookSecret = process.env.EMERGE_WEBHOOK_SECRET;
if (!webhookSecret) {
  throw new Error("Missing EMERGE_WEBHOOK_SECRET");
}

app.post("/webhooks/emerge", async (req, res) => {
  try {
    const signature = req.header("x-signature");
    if (!signature) {
      return res.status(401).send("Missing signature");
    }

    const expected = crypto
      .createHmac("sha256", webhookSecret)
      .update(req.body)
      .digest("hex");

    const matches =
      signature.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(signature, "hex"), Buffer.from(expected, "hex"));

    if (!matches) {
      return res.status(401).send("Invalid signature");
    }

    const payload = JSON.parse(req.body.toString("utf8")) as {
      event: string;
      uid: string;
      sources?: Array<{ provider: string; reason?: string }>;
    };

    if (payload.event === "consent.revoked") {
      await revokeUserAccess(payload.uid, payload.sources ?? []);
    }

    return res.status(200).send("OK");
  } catch (error) {
    console.error("Webhook error", error);
    return res.status(500).send("Server error");
  }
});

async function revokeUserAccess(uid: string, sources: Array<{ provider: string }>) {
  for (const source of sources) {
    await deleteProviderData(uid, source.provider);
  }
}

async function deleteProviderData(uid: string, provider: string) {
  console.log(`Deleting ${provider} data for ${uid}`);
}

import hashlib
import hmac
import json
import os
from fastapi import FastAPI, HTTPException, Request

app = FastAPI()
webhook_secret = os.getenv("EMERGE_WEBHOOK_SECRET")
if not webhook_secret:
    raise RuntimeError("Missing EMERGE_WEBHOOK_SECRET")

@app.post("/webhooks/emerge")
async def handle_webhook(request: Request):
    body = await request.body()
    signature = request.headers.get("x-signature")
    if not signature:
        raise HTTPException(status_code=401, detail="Missing signature")

    expected = hmac.new(
        webhook_secret.encode(),
        body,
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        raise HTTPException(status_code=401, detail="Invalid signature")

    payload = json.loads(body)
    if payload.get("event") == "consent.revoked":
        uid = payload.get("uid")
        sources = payload.get("sources", [])
        await revoke_user_access(uid, sources)

    return {"status": "ok"}

async def revoke_user_access(uid: str, sources: list[dict]):
    for source in sources:
        provider = source.get("provider", "unknown")
        await delete_provider_data(uid, provider)

async def delete_provider_data(uid: str, provider: str):
    print(f"Deleting {provider} data for {uid}")