Hmac sha256 — auth/hmac_sha256

# examples/auth/hmac_sha256.yaml
#
# Reference config demonstrating the hmac_sha256 auth strategy.
# Multiple signature schemes are registered under this type:
#
#   hmac_sha256_ts_colon  — signed timestamp header, payload "<ts>:<body>"  (Paddle)
#   hmac_sha256_ts_dot    — signed timestamp header, payload "<ts>.<body>"  (Stripe)
#   hmac_sha256_hex       — prefixed hex digest over the raw body            (GitHub)
#   hmac_sha256_base64    — raw base64 digest over the raw body
#   hmac_sha1_hex         — prefixed hex SHA-1 digest (legacy providers)
#
# Timestamped schemes (hmac_sha256_ts_*) require timestamp_tolerance.
# Non-timestamped schemes ignore timestamp_tolerance.

server:
  addr: ":8080"
  max_body_bytes: 1048576

destinations:
  primary:
    type: "rabbitmq"
    rabbitmq:
      url: "${RABBITMQ_URL}"
      exchange: "hookway.webhooks"
      exchange_type: "direct"
      durable: true
      publish_timeout: "5s"
      declare_queues: true

flows:
  # Paddle-style: timestamped HMAC-SHA256, colon-separated payload.
  paddle_billing:
    nodes:
      - {id: in, type: http_trigger, path: /webhooks/paddle, methods: [POST]}
      - {id: body, type: read_body, max_bytes: 1048576}
      - {id: auth, type: auth, scheme: hmac_sha256_ts_colon, secret: "${PADDLE_WEBHOOK_SECRET}", signature_header: Paddle-Signature, timestamp_tolerance: "5m"}
      - {id: env, type: envelope, body_format: json}
      - {id: out, type: publish, destination: primary, target: paddle-webhooks, create: true}
    edges: [in>body, body>auth, auth>env, env>out]

  # GitHub-style: raw hex HMAC-SHA256, no timestamp.
  github_events:
    nodes:
      - {id: in, type: http_trigger, path: /webhooks/github, methods: [POST]}
      - {id: body, type: read_body, max_bytes: 1048576}
      # No idempotency_header field; replay_guard is a separate node.
      - {id: auth, type: auth, scheme: hmac_sha256_hex, secret: "${GITHUB_WEBHOOK_SECRET}", signature_header: X-Hub-Signature-256}
      - {id: env, type: envelope, body_format: json}
      - {id: out, type: publish, destination: primary, target: github-webhooks, create: true}
    edges: [in>body, body>auth, auth>env, env>out]

  # stripe_billing (hmac_sha256_ts_dot / Stripe-Signature) lives in
  # examples/templates/stripe-ingest.yaml.