REST API

curl -X GET "https://app.workskedge.com/api/v1/projects" \
  -H "X-API-Key: wsk_your_api_key_here" \
  -H "Content-Type: application/json"

class WorkSkedgeClient {
  constructor(apiKey, options = {}) {
    if (!apiKey) {
      throw new Error('API key is required');
    }

    this.apiKey = apiKey;
    this.baseUrl = options.baseUrl || 'https://app.workskedge.com/api/v1';
    this.timeout = options.timeout || 30000;
  }

  getHeaders() {
    return {
      'X-API-Key': this.apiKey,
      'Content-Type': 'application/json',
      'User-Agent': 'MyIntegration/1.0'
    };
  }

  maskApiKey(key) {
    if (!key || key.length < 12) return '***';
    return `${key.substring(0, 4)}...${key.substring(key.length - 4)}`;
  }

  log(message, data = {}) {
    const safeData = { ...data };
    if (safeData.apiKey) {
      safeData.apiKey = this.maskApiKey(safeData.apiKey);
    }
    console.log(message, safeData);
  }

  async request(endpoint, options = {}) {
    const url = `${this.baseUrl}${endpoint}`;
    const config = {
      ...options,
      headers: {
        ...this.getHeaders(),
        ...options.headers
      }
    };

    this.log('Making API request', {
      method: config.method || 'GET',
      endpoint,
      hasAuth: !!config.headers['X-API-Key']
    });

    try {
      const controller = new AbortController();
      const timeoutId = setTimeout(() => controller.abort(), this.timeout);

      const response = await fetch(url, {
        ...config,
        signal: controller.signal
      });

      clearTimeout(timeoutId);

      if (!response.ok) {
        throw new Error(`HTTP ${response.status}: ${response.statusText}`);
      }

      return await response.json();
    } catch (error) {
      this.log('API request failed', {
        endpoint,
        error: error.message
      });
      throw error;
    }
  }

  async get(endpoint, params = {}) {
    const queryString = new URLSearchParams(params).toString();
    const url = queryString ? `${endpoint}?${queryString}` : endpoint;
    return this.request(url, { method: 'GET' });
  }

  async post(endpoint, data) {
    return this.request(endpoint, {
      method: 'POST',
      body: JSON.stringify(data)
    });
  }

  async put(endpoint, data) {
    return this.request(endpoint, {
      method: 'PUT',
      body: JSON.stringify(data)
    });
  }

  async delete(endpoint) {
    return this.request(endpoint, { method: 'DELETE' });
  }
}

const client = new WorkSkedgeClient(process.env.WORKSKEDGE_API_KEY);

const projects = await client.get('/projects');
const newWorkOrder = await client.post('/work-orders', {
  title: 'Install HVAC',
  project_id: 'proj_123'
});

const crypto = require('crypto');

class WebhookVerifier {
  constructor(webhookSecret) {
    if (!webhookSecret) {
      throw new Error('Webhook secret is required');
    }
    this.secret = webhookSecret;
  }

  verify(payload, signature, timestamp) {
    const now = Math.floor(Date.now() / 1000);
    if (Math.abs(now - timestamp) > 300) {
      console.error('Webhook timestamp is too old');
      return false;
    }

    const signedPayload = `${timestamp}.${payload}`;
    const expectedSignature = crypto
      .createHmac('sha256', this.secret)
      .update(signedPayload)
      .digest('hex');

    try {
      return crypto.timingSafeEqual(
        Buffer.from(signature),
        Buffer.from(expectedSignature)
      );
    } catch (error) {
      console.error('Signature comparison failed:', error);
      return false;
    }
  }

  middleware() {
    return (req, res, next) => {
      const signature = req.headers['x-workskedge-signature'];
      const timestamp = req.headers['x-workskedge-timestamp'];
      const payload = JSON.stringify(req.body);

      if (!signature || !timestamp) {
        return res.status(401).json({
          error: 'Missing signature or timestamp headers'
        });
      }

      if (!this.verify(payload, signature, parseInt(timestamp))) {
        return res.status(401).json({
          error: 'Invalid webhook signature'
        });
      }

      next();
    };
  }
}

const verifier = new WebhookVerifier(process.env.WORKSKEDGE_WEBHOOK_SECRET);

app.post('/webhooks/workskedge',
  express.json(),
  verifier.middleware(),
  async (req, res) => {
    const event = req.body;
    console.log('Verified webhook event:', event.event_type);
    res.status(200).json({ received: true });
  }
);

class APIKeyMonitor {
  constructor(apiKey) {
    this.apiKey = apiKey;
    this.requestCounts = new Map();
    this.failedAttempts = 0;
    this.alertThreshold = 10;
  }

  logRequest(endpoint, success, statusCode) {
    const hour = new Date().toISOString().slice(0, 13);
    const key = `${hour}:${endpoint}`;

    if (!this.requestCounts.has(key)) {
      this.requestCounts.set(key, { success: 0, failure: 0 });
    }

    const stats = this.requestCounts.get(key);
    if (success) {
      stats.success++;
      this.failedAttempts = 0;
    } else {
      stats.failure++;
      this.failedAttempts++;

      if (this.failedAttempts >= this.alertThreshold) {
        this.sendAlert('High number of failed API requests', {
          endpoint,
          statusCode,
          failedAttempts: this.failedAttempts
        });
      }
    }

    if (stats.failure > 50) {
      this.sendAlert('Unusually high failure rate', {
        endpoint,
        hour,
        stats
      });
    }
  }

  sendAlert(message, details) {
    console.error('SECURITY ALERT:', message, details);
  }

  getStats() {
    return Array.from(this.requestCounts.entries()).map(([key, stats]) => ({
      timeEndpoint: key,
      ...stats
    }));
  }
}

const monitor = new APIKeyMonitor(process.env.WORKSKEDGE_API_KEY);

async function monitoredRequest(endpoint) {
  try {
    const response = await fetch(endpoint, {
      headers: {
        'X-API-Key': monitor.apiKey,
        'Content-Type': 'application/json'
      }
    });

    monitor.logRequest(endpoint, response.ok, response.status);
    return await response.json();
  } catch (error) {
    monitor.logRequest(endpoint, false, null);
    throw error;
  }
}

HTTP/1.1 200 OK
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 42
X-RateLimit-Reset: 1704140400
Content-Type: application/json

HTTP/1.1 429 Too Many Requests
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1704140460
Retry-After: 60
Content-Type: application/json

{
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded. Please retry after 60 seconds.",
    "details": {
      "limit": 60,
      "window": "1 minute",
      "reset_at": "2024-01-01T15:01:00Z"
    }
  }
}