webhook_server.rb

# frozen_string_literal: true

# A webhook receiver, with no framework.
#
#   export VISION_WEBHOOK_SECRET=whsec_…      # dashboard → Webhooks
#   ruby examples/webhook_server.rb
#
# The endpoint must be HTTPS and must not resolve to a private address, so a bare localhost
# receiver is unreachable by design — put a tunnel (ngrok, cloudflared) in front of it
# while developing.

require "json"
require "socket"
require "vision_api"

SECRET = ENV.fetch("VISION_WEBHOOK_SECRET") { abort("Set VISION_WEBHOOK_SECRET (dashboard → Webhooks).") }

server = TCPServer.new(3000)
puts "listening on http://localhost:3000/hooks/vision"

loop do
  socket = server.accept
  request_line = socket.gets
  next socket.close if request_line.nil?

  method, path, = request_line.split
  headers = {}
  while (line = socket.gets) && line != "\r\n"
    name, _, value = line.chomp.partition(": ")
    headers[name.downcase] = value
  end

  unless method == "POST" && path == "/hooks/vision"
    socket.write("HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\n\r\n")
    next socket.close
  end

  # Read the raw bytes. The signature covers exactly what arrived — parsing first and
  # re-serializing changes key order and whitespace, and the HMAC stops matching.
  body = socket.read(headers["content-length"].to_i).to_s

  begin
    event = VisionAPI::Webhook.verify(body, headers["x-vision-signature"], SECRET)
  rescue VisionAPI::WebhookSignatureError => e
    warn "rejected delivery: #{e.message}"
    socket.write("HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\n\r\n")
    next socket.close
  end

  # Any 2xx is success. Acknowledge immediately and do the work afterwards — a slow handler
  # looks like a failed delivery and earns a retry at +1 m, +5 m, +15 m, +40 m.
  socket.write("HTTP/1.1 202 Accepted\r\nContent-Length: 0\r\n\r\n")
  socket.close

  if event["event"] == "task.failed"
    warn "task #{event['task_id']} failed: #{event.dig('error', 'code')} " \
         "(delivery #{headers['x-vision-delivery']})"
  else
    puts "task #{event['task_id']} completed — #{event['credits_used']} credits"
    puts JSON.generate(event["result"])[0, 300]
  end
end