Add webhook-worker example: one-click Cloudflare Worker for Tango webhooks to Slack - #14
Merged
Conversation
One-click "Deploy to Cloudflare" Worker that posts Tango alert matches to Slack: HMAC signature verify (Web Crypto), delivery_id dedupe via Workers KV, pluggable Slack sink. Registration/subscription via a small Node-SDK register.mjs (@makegov/tango-node); the Worker runtime stays dependency-free. Also reconciles two correctness bugs this surfaced in webhook-receiver: - server.py deduped on a top-level event_id the real payload never sends; now parses the batch envelope and dedupes on delivery_id (payload format §6). - register.py sent query_type="opportunities" (plural), which the API rejects; now the singular "opportunity" with validated filters. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A new cookbook example,
examples/webhook-worker/: a dependency-free Cloudflare Worker that turns Tango webhook deliveries into Slack messages, deployable with a one-click Deploy to Cloudflare button. It verifies theX-Tango-SignatureHMAC (Web Crypto, no SDK), dedupes ondelivery_idvia Workers KV, walksevents[].matches.new[], and posts one Slack message per match. Registration and subscription are handled by a smallregister.mjsusing the Node SDK (@makegov/tango-node); the Worker runtime itself stays dependency-free.Also reconciles two correctness bugs this work surfaced in the existing
webhook-receiverexample:server.pydeduped on a top-levelevent_idthat the real payload never sends. Now it parses the batch envelope and dedupes ondelivery_id, matching the Webhooks payload format (section 6).register.pysentquery_type="opportunities"(plural), which the Tango API rejects withInvalid request parameters. Now the singular"opportunity", with validated filters.Why
Webhooks are a high-value Tango feature with a cold-start problem: standing up a public, signature-verifying, idempotent receiver is a lot of yak-shaving. This collapses it to a button plus two secrets. It also makes the cookbook demonstrate both SDKs cleanly (Python in
webhook-receiver, Node here) instead of one example borrowing the other's registration script.Testing
just webhook-worker-smoke: offline. Signs the sample delivery and asserts signature verification, tamper rejection, and Slack-block building. Passing.200with two Slack messages; a re-sent delivery is deduped (200 duplicate); a bad signature returns401. Dashboard screenshots are indocs/img/.register.mjsverified against the real@makegov/tango-nodeAPI surface (method names, argument shapes, the singularquery_type).Risks / notes
tree/main/..., so it resolves once this merges.docs/img/and apackage-lock.jsonfor reproducible installs.[skip changelog] this cookbook keeps no CHANGELOG.md.
🤖 Generated with Claude Code