Tennis results by webhook

import express from "express";
import crypto from "node:crypto";

const app = express();
const handled = new Set();

function valid(req) {
  const expected = crypto.createHmac("sha256", process.env.CITO_WEBHOOK_SECRET).update(req.body).digest("hex");
  const got = req.get("X-Cito-Signature") || "";
  return got.length === expected.length && crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected));
}

app.post("/cito", express.raw({ type: "application/json" }), async (req, res) => {
  if (!valid(req)) return res.sendStatus(401);
  res.sendStatus(200);
  const id = req.get("X-Cito-Event-Id");
  if (handled.has(id)) return;
  handled.add(id);

  const { event, data: m } = JSON.parse(req.body.toString("utf8"));
  if (event !== "tennis.match.completed") return;

  const how = m.outcome === "COMPLETED" ? "" : ` (${m.outcome.toLowerCase()})`;
  await fetch(process.env.DISCORD_WEBHOOK_URL, {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify({
      content: `🎾 **${m.winner.name}** d. ${m.loser.name} ${m.score}${how}\n${m.tournament_name}, ${m.round_name}`,
    }),
  });
});

app.listen(3000);

import hmac, hashlib, json, os, sqlite3
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["CITO_WEBHOOK_SECRET"].encode()
db = sqlite3.connect("tennis.db", check_same_thread=False)
db.execute("CREATE TABLE IF NOT EXISTS matches (id TEXT PRIMARY KEY, row JSON, has_stats INT)")
db.execute("CREATE TABLE IF NOT EXISTS seen (event_id TEXT PRIMARY KEY)")

@app.post("/cito")
def cito():
    raw = request.get_data()
    if not hmac.compare_digest(hmac.new(SECRET, raw, hashlib.sha256).hexdigest(),
                               request.headers.get("X-Cito-Signature", "")):
        abort(401)
    if db.execute("INSERT OR IGNORE INTO seen VALUES (?)", (request.headers["X-Cito-Event-Id"],)).rowcount == 0:
        return "", 200                      # already handled (a retry)
    p = json.loads(raw)
    m = p["data"]
    if p["event"] in ("tennis.match.completed", "tennis.match.stats_ready"):
        db.execute("INSERT INTO matches VALUES (?, ?, ?) ON CONFLICT(id) DO UPDATE SET row=excluded.row, has_stats=excluded.has_stats",
                   (m["id"], json.dumps(m), int(p["event"] == "tennis.match.stats_ready")))
    db.commit()
    return "", 200