feat(python-sdk): add webhook verification and event handling #344
Conversation
Add webhook support to the Python SDK matching the JS SDK implementation: - Add Webhooks class with verify() and construct_event() methods - Implement HMAC-SHA256 signature verification with timing-safe comparison - Add timestamp validation with configurable tolerance (default 5 minutes) - Add comprehensive webhook event types (18 events: email, contact, domain, test) - Add WebhookVerificationError with typed error codes - Export webhook constants (headers) and types
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
WalkthroughThis pull request adds webhook support to the Python SDK. A new 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 4 files
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="packages/python-sdk/usesend/webhooks.py">
<violation number="1" location="packages/python-sdk/usesend/webhooks.py:287">
P2: Handle invalid UTF-8 payloads so decode errors surface as WebhookVerificationError rather than an uncaught UnicodeDecodeError.</violation>
</file>
<file name="packages/python-sdk/usesend/types.py">
<violation number="1" location="packages/python-sdk/usesend/types.py:472">
P2: EmailWebhookEventType includes events that require extra detail payloads, but EmailWebhookEvent only uses EmailBasePayloadFull. This makes type checking accept "email.bounced/failed/suppressed/opened/clicked" events without their required detail fields. Restrict EmailWebhookEventType to the base email events and rely on the specialized event types for the detailed ones.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
| if isinstance(body, str): | ||
| return body | ||
| if isinstance(body, bytes): | ||
| return body.decode("utf-8") |
There was a problem hiding this comment.
P2: Handle invalid UTF-8 payloads so decode errors surface as WebhookVerificationError rather than an uncaught UnicodeDecodeError.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/python-sdk/usesend/webhooks.py, line 287:
<comment>Handle invalid UTF-8 payloads so decode errors surface as WebhookVerificationError rather than an uncaught UnicodeDecodeError.</comment>
<file context>
@@ -0,0 +1,320 @@
+ if isinstance(body, str):
+ return body
+ if isinstance(body, bytes):
+ return body.decode("utf-8")
+ raise WebhookVerificationError(
+ "INVALID_BODY",
</file context>
| "domain.deleted", | ||
| ] | ||
|
|
||
| EmailWebhookEventType = Literal[ |
There was a problem hiding this comment.
P2: EmailWebhookEventType includes events that require extra detail payloads, but EmailWebhookEvent only uses EmailBasePayloadFull. This makes type checking accept "email.bounced/failed/suppressed/opened/clicked" events without their required detail fields. Restrict EmailWebhookEventType to the base email events and rely on the specialized event types for the detailed ones.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/python-sdk/usesend/types.py, line 472:
<comment>EmailWebhookEventType includes events that require extra detail payloads, but EmailWebhookEvent only uses EmailBasePayloadFull. This makes type checking accept "email.bounced/failed/suppressed/opened/clicked" events without their required detail fields. Restrict EmailWebhookEventType to the base email events and rely on the specialized event types for the detailed ones.</comment>
<file context>
@@ -449,3 +449,407 @@ class CampaignActionResponse(TypedDict, total=False):
+ "domain.deleted",
+]
+
+EmailWebhookEventType = Literal[
+ "email.queued",
+ "email.sent",
</file context>
Add webhook support to the Python SDK matching the JS SDK implementation:
Summary by cubic
Adds secure webhook verification and typed event handling to the Python SDK, matching the JS SDK. Provides HMAC-SHA256 signature checks with timestamp tolerance and a simple API to construct verified events.
Written for commit fbb8197. Summary will update on new commits.
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.