Device Intelligence for Go

package main
import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "io"
    "log"
    "net/http"
    "os"
    "strings"
)
type Event struct {
    VisitorID string `json:"visitorId"`
    Bot       struct {
        Result string `json:"result"`
    } `json:"bot"`
    Decision struct {
        RiskScore int `json:"riskScore"`
    } `json:"decision"`
}
// verify recomputes the HMAC-SHA256 over "<t>.<rawBody>" and compares it.
func verify(body []byte, header, secret string) bool {
    parts := map[string]string{}
    for _, kv := range strings.Split(header, ",") {
        if p := strings.SplitN(kv, "=", 2); len(p) == 2 {
            parts[p[0]] = p[1]
        }
    }
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(parts["t"] + "."))
    mac.Write(body)
    expected := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(expected), []byte(parts["v1"]))
}
func main() {
    secret := os.Getenv("TRACIO_WEBHOOK_SECRET")
    http.HandleFunc("/webhook/tracio", func(w http.ResponseWriter, r *http.Request) {
        body, _ := io.ReadAll(r.Body)
        if !verify(body, r.Header.Get("X-Tracio-Signature"), secret) {
            http.Error(w, "Invalid signature", http.StatusUnauthorized)
            return
        }
        var e Event
        if err := json.Unmarshal(body, &e); err != nil {
            http.Error(w, "Bad payload", http.StatusBadRequest)
            return
        }
        if e.Bot.Result == "bot" || e.Decision.RiskScore > 50 {
            log.Printf("flagging visitor %s (bot=%s risk=%d)",
                e.VisitorID, e.Bot.Result, e.Decision.RiskScore)
        }
        w.WriteHeader(http.StatusOK)
    })
    log.Fatal(http.ListenAndServe(":8080", nil))
}