🔗 Webhook 发布集成文档

received_signature = request.headers["X-GeoSight-Signature"]
timestamp = request.headers["X-GeoSight-Timestamp"]
body = request.raw_body  // 原始 JSON 字符串

expected = "sha256=" + HMAC-SHA256(secret, timestamp + "." + body)

if received_signature != expected:
    return 401 "签名无效"

// 可选：检查 timestamp 在 5 分钟内，防止重放
if abs(now() - int(timestamp)) > 300:
    return 401 "请求已过期"

{
  "ok": true,
  "url": "https://your-site.com/blog/your-article-slug",
  "message": "发布成功"
}

{
  "ok": true,
  "url": null,
  "message": "已接收，稍后发布"
}

{
  "ok": false,
  "error": "分类不存在"
}

const express = require('express');
const crypto = require('crypto');
const app = express();

const SECRET = '你在GeoSight设置页看到的签名密钥';
const processedDeliveries = new Set(); // 生产环境用 Redis/DB

app.post('/api/geosight-webhook', express.raw({ type: '*/*' }), (req, res) => {
  // 1. 验签
  const sig = req.headers['x-geosight-signature'];
  const timestamp = req.headers['x-geosight-timestamp'];
  const body = req.body.toString();
  const expected = 'sha256=' + crypto.createHmac('sha256', SECRET)
    .update(timestamp + '.' + body).digest('hex');
  
  if (sig !== expected) {
    return res.status(401).json({ ok: false, error: '签名无效' });
  }

  // 2. 幂等检查
  const deliveryId = req.headers['x-geosight-delivery'];
  if (processedDeliveries.has(deliveryId)) {
    return res.json({ ok: true, url: null, message: '已处理' });
  }

  // 3. 解析内容
  const data = JSON.parse(body);
  const { content, seo, brand } = data;

  // 4. 发布到你的 CMS/数据库
  const slug = seo.suggested_slug;
  const url = `https://your-site.com/blog/${slug}`;
  
  // 示例：写入数据库
  // await db.posts.create({
  //   title: content.title,
  //   body: content.body_html,
  //   slug: slug,
  //   jsonLd: content.json_ld,
  //   metaTitle: seo.meta_title,
  //   metaDescription: seo.meta_description,
  // });

  console.log(`[GeoSight] 收到内容: ${content.title}`);

  // 5. 记录并返回
  processedDeliveries.add(deliveryId);
  res.json({ ok: true, url, message: '发布成功' });
});

app.listen(3000);

import hmac
import hashlib
from fastapi import FastAPI, Request, HTTPException
from pydantic import BaseModel

app = FastAPI()
SECRET = "你在GeoSight设置页看到的签名密钥"
processed = set()

@app.post("/api/geosight-webhook")
async def geosight_webhook(request: Request):
    # 1. 验签
    body = await request.body()
    sig = request.headers.get("x-geosight-signature", "")
    timestamp = request.headers.get("x-geosight-timestamp", "")
    
    expected = "sha256=" + hmac.new(
        SECRET.encode(), 
        f"{timestamp}.{body.decode()}".encode(), 
        hashlib.sha256
    ).hexdigest()
    
    if not hmac.compare_digest(sig, expected):
        raise HTTPException(401, "签名无效")

    # 2. 幂等检查
    delivery_id = request.headers.get("x-geosight-delivery", "")
    if delivery_id in processed:
        return {"ok": True, "url": None, "message": "已处理"}

    # 3. 解析内容
    import json
    data = json.loads(body)
    content = data["content"]
    seo = data["seo"]
    
    # 4. 发布到你的 CMS
    slug = seo["suggested_slug"]
    url = f"https://your-site.com/blog/{slug}"
    
    # await db.posts.create(title=content["title"], body=content["body_html"], ...)

    # 5. 记录并返回
    processed.add(delivery_id)
    return {"ok": True, "url": url, "message": "发布成功"}