Post prospect replies to Slack

// server.mjs
import crypto from "node:crypto";
import express from "express";

const secret = process.env.VICTORIA_WEBHOOK_SECRET;
const slackWebhookUrl = process.env.SLACK_WEBHOOK_URL;
// Keys already posted. In production, store them in a database or Redis.
const processed = new Set();

function isValidSignature(rawBody, header) {
  if (typeof header !== "string") return false;
  const digest = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const expected = Buffer.from(`sha256=${digest}`);
  const received = Buffer.from(header);
  return expected.length === received.length && crypto.timingSafeEqual(expected, received);
}

// Slack treats &, < and > as control characters in message text.
function escapeForSlack(text) {
  return String(text).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
}

function slackMessage(event) {
  const lead = event.lead ?? {};
  const name = [lead.first_name, lead.last_name].filter(Boolean).join(" ") || "A prospect";
  const who = lead.company ? `${name} (${lead.company})` : name;
  const channel = event.channel === "linkedin" ? "on LinkedIn" : "by email";
  const reply = event.prospect_message ?? "";
  const excerpt = reply.length > 1000 ? `${reply.slice(0, 1000)}…` : reply;
  const sentiment = event.ai_response?.sentiment;

  const campaign = escapeForSlack(event.campaign ?? "a campaign");
  const lines = [`*${escapeForSlack(who)}* replied ${channel} to *${campaign}*`];
  if (sentiment) lines.push(`Sentiment: ${escapeForSlack(sentiment)}`);
  lines.push(...escapeForSlack(excerpt).split("\n").map((line) => `> ${line}`));
  return { text: lines.join("\n") };
}

const app = express();
// express.raw keeps the body as the exact bytes that were signed.
const rawJson = express.raw({ type: "application/json" });

app.post("/victoria/webhooks", rawJson, async (req, res) => {
  if (!isValidSignature(req.body, req.get("X-Signature-256"))) return res.sendStatus(401);

  const event = JSON.parse(req.body.toString("utf8"));
  if (event.event !== "prospect_response" || processed.has(event.idempotency_key)) {
    return res.sendStatus(200);
  }

  try {
    const slack = await fetch(slackWebhookUrl, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify(slackMessage(event)),
      signal: AbortSignal.timeout(10_000),
    });
    if (!slack.ok) throw new Error(`Slack answered ${slack.status}`);
  } catch (error) {
    console.error(`Couldn't post to Slack: ${error.message}`);
    // An error status marks the delivery as failed, so Victoria AI can retry it.
    return res.sendStatus(502);
  }

  processed.add(event.idempotency_key);
  res.sendStatus(200);
});

app.listen(3000, () => console.log("Listening on port 3000"));

# server.py
import hashlib
import hmac
import os

import requests
from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["VICTORIA_WEBHOOK_SECRET"].encode()
SLACK_WEBHOOK_URL = os.environ["SLACK_WEBHOOK_URL"]
# Keys already posted. In production, store them in a database or Redis.
processed = set()


def is_valid_signature(raw_body: bytes, header: str | None) -> bool:
    if not header:
        return False
    expected = "sha256=" + hmac.new(SECRET, raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header)


def escape_for_slack(text) -> str:
    # Slack treats &, < and > as control characters in message text.
    return str(text).replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;")


def slack_message(event: dict) -> dict:
    lead = event.get("lead") or {}
    parts = (lead.get("first_name"), lead.get("last_name"))
    name = " ".join(part for part in parts if part) or "A prospect"
    who = f"{name} ({lead['company']})" if lead.get("company") else name
    channel = "on LinkedIn" if event.get("channel") == "linkedin" else "by email"
    reply = event.get("prospect_message") or ""
    excerpt = reply[:1000] + "…" if len(reply) > 1000 else reply
    sentiment = (event.get("ai_response") or {}).get("sentiment")

    campaign = event.get("campaign") or "a campaign"
    lines = [f"*{escape_for_slack(who)}* replied {channel} to *{escape_for_slack(campaign)}*"]
    if sentiment:
        lines.append(f"Sentiment: {escape_for_slack(sentiment)}")
    lines.extend(f"> {line}" for line in escape_for_slack(excerpt).split("\n"))
    return {"text": "\n".join(lines)}


@app.post("/victoria/webhooks")
def victoria_webhook():
    raw_body = request.get_data()  # the exact bytes that were signed
    if not is_valid_signature(raw_body, request.headers.get("X-Signature-256")):
        abort(401)

    event = request.get_json()
    if event.get("event") != "prospect_response" or event.get("idempotency_key") in processed:
        return "", 200

    try:
        slack = requests.post(SLACK_WEBHOOK_URL, json=slack_message(event), timeout=10)
        slack.raise_for_status()
    except requests.RequestException as error:
        app.logger.error("Couldn't post to Slack: %s", error)
        # An error status marks the delivery as failed, so Victoria AI can retry it.
        abort(502)

    processed.add(event["idempotency_key"])
    return "", 200