Publish with a webhook

// Searchlark webhook receiver for Node.js 18+ (no dependencies).
// Run: SEARCHLARK_WEBHOOK_SECRET=... PORT=8080 node searchlark-webhook.mjs
import { createServer } from "node:http";
import { createHmac, timingSafeEqual } from "node:crypto";

const SECRET = process.env.SEARCHLARK_WEBHOOK_SECRET ?? "";
const SITE = process.env.SITE_URL ?? "https://yoursite.com";
const AS_DRAFT = process.env.SEARCHLARK_AS_DRAFT === "1"; // save drafts instead of live posts

// Check the signature on the raw body, before parsing it.
function verify(raw, header) {
  const parts = Object.fromEntries(String(header ?? "").split(",").map((p) => p.trim().split("=", 2)));
  const t = Number(parts.t);
  if (!SECRET || !parts.v1 || !Number.isInteger(t) || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = Buffer.from(createHmac("sha256", SECRET).update(`${t}.${raw}`).digest("hex"));
  const given = Buffer.from(parts.v1);
  return expected.length === given.length && timingSafeEqual(expected, given);
}

// Replace with your CMS or database. Upsert by idempotency_key: updates reuse it.
const posts = new Map();
async function savePost(a) {
  const existing = posts.get(a.idempotency_key);
  const id = existing?.id ?? String(posts.size + 1);
  const slug = existing?.slug ?? a.slug ?? `post-${id}`;
  posts.set(a.idempotency_key, { id, slug, title: a.title, html: a.html, draft: AS_DRAFT });
  return { id, url: `${SITE}/blog/${slug}` }; // absolute URL of the live post
}

createServer((req, res) => {
  const reply = (status, body) => {
    res.writeHead(status, { "content-type": "application/json" });
    res.end(JSON.stringify(body ?? {}));
  };
  if (req.method !== "POST") return reply(405);
  const chunks = [];
  let size = 0;
  req.on("data", (c) => {
    size += c.length;
    if (size <= 5_000_000) chunks.push(c);
  });
  req.on("end", async () => {
    const raw = Buffer.concat(chunks).toString("utf8");
    if (!verify(raw, req.headers["x-searchlark-signature"])) return reply(401, { error: "bad signature" });
    const msg = JSON.parse(raw);
    if (msg.event === "ping") return reply(200, { ok: true });
    // Never publish tests: answer as if you had.
    if (msg.event === "article.test") return reply(200, { id: "test", url: `${SITE}/blog/searchlark-test` });
    if (msg.event === "article.publish") return reply(200, await savePost(msg.data));
    return reply(200, { ok: true }); // new event types may be added: acknowledge them
  });
}).listen(Number(process.env.PORT ?? 8080));

// app/api/searchlark/route.ts: Searchlark webhook receiver for Next.js (App Router).
import { createHmac, timingSafeEqual } from "node:crypto";

export const runtime = "nodejs";
const SITE = "https://yoursite.com";

function verify(raw: string, header: string | null): boolean {
  const secret = process.env.SEARCHLARK_WEBHOOK_SECRET ?? "";
  const parts = Object.fromEntries((header ?? "").split(",").map((p) => p.trim().split("=", 2)));
  const t = Number(parts.t);
  if (!secret || !parts.v1 || !Number.isInteger(t) || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = Buffer.from(createHmac("sha256", secret).update(`${t}.${raw}`).digest("hex"));
  const given = Buffer.from(parts.v1);
  return expected.length === given.length && timingSafeEqual(expected, given);
}

export async function POST(req: Request) {
  const raw = await req.text(); // the raw body: verify before parsing
  if (!verify(raw, req.headers.get("x-searchlark-signature")))
    return Response.json({ error: "bad signature" }, { status: 401 });
  const msg = JSON.parse(raw);
  if (msg.event === "ping") return Response.json({ ok: true });
  if (msg.event === "article.test")
    return Response.json({ id: "test", url: `${SITE}/blog/searchlark-test` }); // never publish tests
  if (msg.event === "article.publish") {
    const a = msg.data;
    // Save to your CMS or database: create on the first idempotency_key, update after that.
    const post = await savePost(a);
    return Response.json({ id: post.id, url: `${SITE}/blog/${post.slug}` });
  }
  return Response.json({ ok: true });
}

async function savePost(a: { idempotency_key: string; slug: string | null; title: string; html: string }) {
  // Replace with your data layer, for example:
  // return db.post.upsert({ where: { searchlarkKey: a.idempotency_key }, create: {...}, update: {...} })
  return { id: a.idempotency_key, slug: a.slug ?? "post" };
}

<?php
// searchlark-webhook.php: Searchlark webhook receiver for PHP 8+.
$secret = getenv('SEARCHLARK_WEBHOOK_SECRET') ?: '';
$site = 'https://yoursite.com';
$raw = file_get_contents('php://input'); // the raw body: verify before decoding

function searchlark_verify(string $secret, string $raw, string $header): bool {
    $parts = [];
    foreach (explode(',', $header) as $p) {
        [$k, $v] = array_pad(explode('=', trim($p), 2), 2, '');
        $parts[$k] = $v;
    }
    $t = (int) ($parts['t'] ?? 0);
    if ($secret === '' || empty($parts['v1']) || abs(time() - $t) > 300) return false;
    $expected = hash_hmac('sha256', $t . '.' . $raw, $secret);
    return hash_equals($expected, $parts['v1']);
}

header('Content-Type: application/json');
if (!searchlark_verify($secret, $raw, $_SERVER['HTTP_X_SEARCHLARK_SIGNATURE'] ?? '')) {
    http_response_code(401);
    echo json_encode(['error' => 'bad signature']);
    exit;
}
$msg = json_decode($raw, true);
switch ($msg['event'] ?? '') {
    case 'ping':
        echo json_encode(['ok' => true]);
        break;
    case 'article.test': // never publish tests
        echo json_encode(['id' => 'test', 'url' => $site . '/blog/searchlark-test']);
        break;
    case 'article.publish':
        $a = $msg['data'];
        // Save to your CMS: create on the first idempotency_key, update after that.
        $id = substr(hash('sha256', $a['idempotency_key']), 0, 12);
        $slug = $a['slug'] ?: 'post-' . $id;
        echo json_encode(['id' => $id, 'url' => $site . '/blog/' . $slug]);
        break;
    default:
        echo json_encode(['ok' => true]);
}

# searchlark_webhook.py: Searchlark webhook receiver (Python 3.9+, standard library only).
# Run: SEARCHLARK_WEBHOOK_SECRET=... PORT=8080 python3 searchlark_webhook.py
import hashlib, hmac, json, os, time
from http.server import BaseHTTPRequestHandler, HTTPServer

SECRET = os.environ.get("SEARCHLARK_WEBHOOK_SECRET", "")
SITE = os.environ.get("SITE_URL", "https://yoursite.com")
POSTS = {}  # replace with your CMS or database


def verify(raw: bytes, header: str) -> bool:
    parts = dict(p.strip().split("=", 1) for p in header.split(",") if "=" in p)
    try:
        t = int(parts.get("t", ""))
    except ValueError:
        return False
    if not SECRET or not parts.get("v1") or abs(time.time() - t) > 300:
        return False
    expected = hmac.new(SECRET.encode(), f"{t}.".encode() + raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts["v1"])


def save_post(a: dict) -> dict:
    # Create on the first idempotency_key, update after that.
    post = POSTS.get(a["idempotency_key"]) or {"id": str(len(POSTS) + 1)}
    post.update(title=a["title"], html=a["html"], slug=post.get("slug") or a.get("slug") or "post-" + post["id"])
    POSTS[a["idempotency_key"]] = post
    return {"id": post["id"], "url": f"{SITE}/blog/{post['slug']}"}


class Handler(BaseHTTPRequestHandler):
    def reply(self, status: int, body: dict) -> None:
        data = json.dumps(body).encode()
        self.send_response(status)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(data)))
        self.end_headers()
        self.wfile.write(data)

    def do_POST(self) -> None:
        length = int(self.headers.get("Content-Length") or 0)
        if length > 5_000_000:  # Searchlark sends at most about 2 MB
            return self.reply(413, {"error": "too large"})
        raw = self.rfile.read(length)
        if not verify(raw, self.headers.get("X-Searchlark-Signature", "")):
            return self.reply(401, {"error": "bad signature"})
        msg = json.loads(raw)
        if msg.get("event") == "ping":
            return self.reply(200, {"ok": True})
        if msg.get("event") == "article.test":  # never publish tests
            return self.reply(200, {"id": "test", "url": f"{SITE}/blog/searchlark-test"})
        if msg.get("event") == "article.publish":
            return self.reply(200, save_post(msg["data"]))
        return self.reply(200, {"ok": True})

    def log_message(self, *args) -> None:
        pass


if __name__ == "__main__":
    HTTPServer(("0.0.0.0", int(os.environ.get("PORT", "8080"))), Handler).serve_forever()

// worker.js: Searchlark webhook receiver for Cloudflare Workers (Web Crypto).
const SITE = "https://yoursite.com";

async function verify(secret, raw, header) {
  const parts = Object.fromEntries((header ?? "").split(",").map((p) => p.trim().split("=", 2)));
  const t = Number(parts.t);
  if (!secret || !parts.v1 || !Number.isInteger(t) || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
  const mac = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${t}.${raw}`));
  const hex = [...new Uint8Array(mac)].map((b) => b.toString(16).padStart(2, "0")).join("");
  if (hex.length !== parts.v1.length) return false;
  let diff = 0;
  for (let i = 0; i < hex.length; i++) diff |= hex.charCodeAt(i) ^ parts.v1.charCodeAt(i);
  return diff === 0;
}

export default {
  async fetch(req, env) {
    if (req.method !== "POST") return new Response(null, { status: 405 });
    const raw = await req.text(); // the raw body: verify before parsing
    if (!(await verify(env.SEARCHLARK_WEBHOOK_SECRET, raw, req.headers.get("x-searchlark-signature"))))
      return Response.json({ error: "bad signature" }, { status: 401 });
    const msg = JSON.parse(raw);
    if (msg.event === "ping") return Response.json({ ok: true });
    if (msg.event === "article.test") return Response.json({ id: "test", url: `${SITE}/blog/searchlark-test` });
    if (msg.event === "article.publish") {
      const a = msg.data;
      // Save to your CMS (for example its REST API): create on the first idempotency_key, then update.
      return Response.json({ id: a.idempotency_key, url: `${SITE}/blog/${a.slug ?? "post"}` });
    }
    return Response.json({ ok: true });
  },
};