コールバックによるプッシュ配信

curl https://api.widerouter.com/v1/task/submit \
  -H "Authorization: Bearer $WIDEROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gemini-3-pro-image",
    "input": { "prompt": "a paper crane on a walnut desk" },
    "callback_url": "https://your-app.example/hooks/widerouter/9f2c1e7b0a4d",
    "callback_secret": "your-callback-secret-at-least-16-bytes"
  }'

import os, requests

resp = requests.post(
    "https://api.widerouter.com/v1/task/submit",
    headers={"Authorization": f"Bearer {os.environ['WIDEROUTER_API_KEY']}"},
    json={
        "model": "gemini-3-pro-image",
        "input": {"prompt": "a paper crane on a walnut desk"},
        "callback_url": "https://your-app.example/hooks/widerouter/9f2c1e7b0a4d",
        "callback_secret": os.environ["WIDEROUTER_CALLBACK_SECRET"],
    },
)
task_id = resp.json()["id"]   # remember it: it is how you match the callback

import hmac, hashlib, time

def verify(secret: str, header: str, raw_body: bytes, tolerance: int = 300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t, v1 = int(parts["t"]), parts["v1"]
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(secret, header, rawBody, tolerance = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2)));
  const t = Number(parts.t);
  if (!Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > tolerance) return false;
  const expected = createHmac("sha256", secret).update(`${t}.`).update(rawBody).digest("hex");
  const a = Buffer.from(expected), b = Buffer.from(parts.v1 ?? "");
  return a.length === b.length && timingSafeEqual(a, b);
}

static boolean verify(String secret, String header, byte[] rawBody, long tolerance) throws Exception {
  long t = 0; String v1 = "";
  for (String kv : header.split(",")) {
    String[] p = kv.split("=", 2);
    if (p[0].equals("t")) t = Long.parseLong(p[1]);
    if (p[0].equals("v1")) v1 = p[1];
  }
  if (Math.abs(System.currentTimeMillis() / 1000 - t) > tolerance) return false;
  Mac mac = Mac.getInstance("HmacSHA256");
  mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
  mac.update((t + ".").getBytes(StandardCharsets.UTF_8));
  return MessageDigest.isEqual(mac.doFinal(rawBody), HexFormat.of().parseHex(v1));
}

import os, requests
from flask import Flask, request

app = Flask(__name__)
API_KEY = os.environ["WIDEROUTER_API_KEY"]
CALLBACK_SECRET = os.environ["WIDEROUTER_CALLBACK_SECRET"]
SEEN = set()   # use your database in production

@app.post("/hooks/widerouter/<secret>")
def widerouter_hook(secret):
    if secret != os.environ["HOOK_SECRET"]:
        return "", 404
    if not verify(CALLBACK_SECRET, request.headers.get("X-Wide-Signature", ""), request.get_data()):
        return "", 401
    task_id = request.headers.get("X-Wide-Task-Id", "")
    event = request.headers.get("X-Wide-Event", "")
    if task_id in SEEN:
        return "", 200                 # retry of a task we already handled
    SEEN.add(task_id)
    enqueue(task_id, event)            # your job queue; returns instantly
    return "", 200

def worker(task_id, event):
    task = requests.get(
        f"https://api.widerouter.com/v1/task/{task_id}",
        headers={"Authorization": f"Bearer {API_KEY}"},
    ).json()
    if task["status"] != "completed":
        record_failure(task_id, task.get("error"))
        return
    for i, url in enumerate(task["outputs"]):
        with open(f"{task_id}_{i}.jpg", "wb") as f:
            f.write(requests.get(url, timeout=60).content)

import fs from "node:fs";
import express from "express";

const app = express();
const API_KEY = process.env.WIDEROUTER_API_KEY;
const CALLBACK_SECRET = process.env.WIDEROUTER_CALLBACK_SECRET;
const seen = new Set(); // use your database in production

// express.raw keeps the body as bytes: the signature is over the raw body
app.post("/hooks/widerouter/:secret", express.raw({ type: "application/json" }), (req, res) => {
  if (req.params.secret !== process.env.HOOK_SECRET) return res.sendStatus(404);
  if (!verify(CALLBACK_SECRET, req.get("X-Wide-Signature") ?? "", req.body)) return res.sendStatus(401);
  const taskId = req.get("X-Wide-Task-Id");
  const event = req.get("X-Wide-Event");
  if (seen.has(taskId)) return res.sendStatus(200); // retry, already handled
  seen.add(taskId);
  res.sendStatus(200);                              // acknowledge first
  setImmediate(() => worker(taskId, event));        // then do the slow part
});

async function worker(taskId) {
  const task = await fetch(`https://api.widerouter.com/v1/task/${taskId}`, {
    headers: { Authorization: `Bearer ${API_KEY}` },
  }).then((r) => r.json());
  if (task.status !== "completed") return recordFailure(taskId, task.error);
  for (const [i, url] of task.outputs.entries()) {
    const bytes = Buffer.from(await (await fetch(url)).arrayBuffer());
    await fs.promises.writeFile(`${taskId}_${i}.jpg`, bytes);
  }
}

@RestController
public class WideRouterHook {
  private final String apiKey = System.getenv("WIDEROUTER_API_KEY");
  private final String callbackSecret = System.getenv("WIDEROUTER_CALLBACK_SECRET");
  private final Set<String> seen = ConcurrentHashMap.newKeySet(); // use a DB in production

  @PostMapping("/hooks/widerouter/{secret}")
  public ResponseEntity<Void> onTask(@PathVariable String secret,
                                     @RequestHeader("X-Wide-Task-Id") String taskId,
                                     @RequestHeader("X-Wide-Event") String event,
                                     @RequestHeader(value = "X-Wide-Signature", required = false) String signature,
                                     @RequestBody byte[] rawBody) throws Exception {
    if (!secret.equals(System.getenv("HOOK_SECRET"))) return ResponseEntity.notFound().build();
    if (signature == null || !verify(callbackSecret, signature, rawBody, 300)) return ResponseEntity.status(401).build();
    if (!seen.add(taskId)) return ResponseEntity.ok().build();   // retry, already handled
    executor.submit(() -> download(taskId));                     // acknowledge first
    return ResponseEntity.ok().build();
  }

  void download(String taskId) throws Exception {
    HttpRequest read = HttpRequest.newBuilder(URI.create("https://api.widerouter.com/v1/task/" + taskId))
        .header("Authorization", "Bearer " + apiKey).GET().build();
    JsonNode task = mapper.readTree(http.send(read, BodyHandlers.ofString()).body());
    if (!"completed".equals(task.get("status").asText())) { recordFailure(taskId, task.get("error")); return; }
    int i = 0;
    for (JsonNode url : task.get("outputs")) {
      HttpRequest get = HttpRequest.newBuilder(URI.create(url.asText())).GET().build();
      Files.write(Path.of(taskId + "_" + (i++) + ".jpg"), http.send(get, BodyHandlers.ofByteArray()).body());
    }
  }
}