Scénarios de Demandes de Signature

import express from 'express'
import crypto from 'crypto'

const app = express()
const API_KEY = process.env.FIRMA_API_KEY
const WEBHOOK_SECRET = process.env.FIRMA_WEBHOOK_SECRET
const API_BASE = 'https://api.firma.dev/functions/v1/signing-request-api'

app.post('/webhooks/firma',
  express.raw({ type: 'application/json' }),
  async (req, res) => {
    const payload = req.body.toString('utf8')
    if (!verifySignature(payload, req.headers['x-firma-signature'], WEBHOOK_SECRET)) {
      return res.status(401).json({ error: 'Invalid signature' })
    }

    const event = JSON.parse(payload)
    res.status(200).json({ received: true }) // ack immediately

    if (event.type !== 'signing_request.completed') return

    const signingRequestId = event.data.signing_request.id

    // Look up whether this request is one of our "signer 1 only" requests
    const original = await db.pendingChains.findOne({ signing_request_id: signingRequestId })
    if (!original) return // not part of a dynamic-signer chain, ignore

    // Signer 1's field values aren't in the webhook payload — fetch them
    const fieldsResp = await fetch(`${API_BASE}/signing-requests/${signingRequestId}/fields`, {
      headers: { Authorization: `Bearer ${API_KEY}` }
    })
    const { results: fields } = await fieldsResp.json()
    const nextSignerField = fields.find(f => f.variable_name === 'next_signer_email')
    const nextSignerEmail = nextSignerField?.final_value

    if (!nextSignerEmail) {
      console.error(`No next_signer_email captured on ${signingRequestId}`)
      return
    }

    // Create and send request #2 for the dynamically-determined signer
    const createResp = await fetch(`${API_BASE}/signing-requests/create-and-send`, {
      method: 'POST',
      headers: {
        Authorization: `Bearer ${API_KEY}`,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({
        name: `${event.data.signing_request.name} - Second Signer`,
        template_id: original.template_id,
        recipients: [
          {
            first_name: 'Next',
            last_name: 'Signer',
            email: nextSignerEmail,
            designation: 'Signer',
            order: 1
          }
        ]
      })
    })
    const created = await createResp.json()

    // Persist the link between the two requests yourself — Firma doesn't track it
    await db.pendingChains.update(
      { signing_request_id: signingRequestId },
      { $set: { chained_signing_request_id: created.id, resolved_at: new Date() } }
    )
  }
)

function verifySignature(payload, signatureHeader, secret) {
  if (!signatureHeader) return false
  const parts = {}
  signatureHeader.split(',').forEach(part => {
    const [key, value] = part.split('=')
    parts[key] = value
  })
  if (!parts.t || !parts.v1) return false
  const signedPayload = `${parts.t}.${payload}`
  const expected = crypto.createHmac('sha256', secret).update(signedPayload).digest('hex')
  try {
    return crypto.timingSafeEqual(Buffer.from(parts.v1), Buffer.from(expected))
  } catch {
    return false
  }
}

app.listen(3000)

import os
import hmac
import hashlib
import requests
from flask import Flask, request, jsonify

app = Flask(__name__)
API_KEY = os.environ['FIRMA_API_KEY']
WEBHOOK_SECRET = os.environ['FIRMA_WEBHOOK_SECRET']
API_BASE = 'https://api.firma.dev/functions/v1/signing-request-api'

@app.route('/webhooks/firma', methods=['POST'])
def firma_webhook():
    payload = request.get_data(as_text=True)
    if not verify_signature(payload, request.headers.get('X-Firma-Signature'), WEBHOOK_SECRET):
        return jsonify({'error': 'Invalid signature'}), 401

    event = request.get_json()
    if event['type'] != 'signing_request.completed':
        return jsonify({'received': True}), 200

    signing_request_id = event['data']['signing_request']['id']

    original = db.pending_chains.find_one({'signing_request_id': signing_request_id})
    if not original:
        return jsonify({'received': True}), 200

    fields_resp = requests.get(
        f"{API_BASE}/signing-requests/{signing_request_id}/fields",
        headers={'Authorization': f"Bearer {API_KEY}"}
    )
    fields = fields_resp.json()['results']
    next_signer_field = next((f for f in fields if f.get('variable_name') == 'next_signer_email'), None)
    next_signer_email = next_signer_field.get('final_value') if next_signer_field else None

    if not next_signer_email:
        return jsonify({'received': True}), 200

    create_resp = requests.post(
        f"{API_BASE}/signing-requests/create-and-send",
        headers={'Authorization': f"Bearer {API_KEY}", 'Content-Type': 'application/json'},
        json={
            'name': f"{event['data']['signing_request']['name']} - Second Signer",
            'template_id': original['template_id'],
            'recipients': [{
                'first_name': 'Next',
                'last_name': 'Signer',
                'email': next_signer_email,
                'designation': 'Signer',
                'order': 1
            }]
        }
    )
    created = create_resp.json()

    db.pending_chains.update_one(
        {'signing_request_id': signing_request_id},
        {'$set': {'chained_signing_request_id': created['id']}}
    )

    return jsonify({'received': True}), 200

def verify_signature(payload, signature_header, secret):
    if not signature_header:
        return False
    parts = dict(p.split('=') for p in signature_header.split(','))
    if 't' not in parts or 'v1' not in parts:
        return False
    signed_payload = f"{parts['t']}.{payload}"
    expected = hmac.new(secret.encode(), signed_payload.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(parts['v1'], expected)

if __name__ == '__main__':
    app.run(port=3000)

// Step 1: Your backend creates the signing request and returns the recipient's signing URL
const { signingUrl, signingRequestId } = await fetch('/api/create-dynamic-signer-request', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ documentId, signer1Email, signer1Name })
}).then(r => r.json())

// Step 2: Embed signer 1's signing view
const iframe = document.createElement('iframe')
iframe.src = signingUrl
iframe.style.width = '100%'
iframe.style.height = '900px'
iframe.frameBorder = '0'
iframe.allow = 'camera;microphone;clipboard-write'
document.getElementById('signing-container').appendChild(iframe)

// Step 3: Listen for completion
window.addEventListener('message', async (event) => {
  if (event.data?.type !== 'firma:signing:completed') return

  // Step 4: Your backend reads the field, creates request #2, returns signer 2's signing URL
  const { signingUrl: signer2Url } = await fetch('/api/chain-dynamic-signer', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ originalSigningRequestId: signingRequestId })
  }).then(r => r.json())

  // Step 5: Embed signer 2's signing view
  iframe.src = signer2Url
})

import express from 'express'

const app = express()
app.use(express.json())

const API_KEY = process.env.FIRMA_API_KEY
const API_BASE = 'https://api.firma.dev/functions/v1/signing-request-api'

// Step 1: Create request #1 for signer 1
app.post('/api/create-dynamic-signer-request', async (req, res) => {
  const { documentId, signer1Email, signer1Name } = req.body

  const resp = await fetch(`${API_BASE}/signing-requests/create-and-send`, {
    method: 'POST',
    headers: { Authorization: `Bearer ${API_KEY}`, 'Content-Type': 'application/json' },
    body: JSON.stringify({
      name: 'Contract — Dynamic Signer',
      document_id: documentId,
      settings: { send_signing_email: false },
      recipients: [{
        first_name: signer1Name.split(' ')[0],
        last_name: signer1Name.split(' ').slice(1).join(' ') || signer1Name,
        email: signer1Email,
        designation: 'Signer',
        order: 1
      }],
      fields: [{
        type: 'text',
        variable_name: 'next_signer_email',
        required: true,
        x: 50, y: 700, width: 200, height: 30, page: 0,
        recipient_order: 1
      }]
    })
  })
  const data = await resp.json()
  const recipient = data.recipients[0]
  const signingUrl = `https://app.firma.dev/signing/${recipient.id}`

  res.json({ signingUrl, signingRequestId: data.id })
})

// Steps 3–4: Read signer 2's email, create request #2 with editable identity
app.post('/api/chain-dynamic-signer', async (req, res) => {
  const { originalSigningRequestId } = req.body

  // Read signer 1's field values
  const fieldsResp = await fetch(
    `${API_BASE}/signing-requests/${originalSigningRequestId}/fields`,
    { headers: { Authorization: `Bearer ${API_KEY}` } }
  )
  const { results: fields } = await fieldsResp.json()
  const nextEmail = fields.find(f => f.variable_name === 'next_signer_email')?.final_value

  if (!nextEmail) return res.status(400).json({ error: 'Signer 1 did not provide next signer email' })

  // Create request #2 with identity_editable_fields
  const createResp = await fetch(`${API_BASE}/signing-requests/create-and-send`, {
    method: 'POST',
    headers: { Authorization: `Bearer ${API_KEY}`, 'Content-Type': 'application/json' },
    body: JSON.stringify({
      name: 'Contract — Second Signer',
      document_id: req.body.documentId || null,
      template_id: req.body.templateId || null,
      settings: {
        send_signing_email: false,
        identity_editable_fields: ['first_name', 'last_name', 'email'],
        notify_identity_change_email: 1
      },
      recipients: [{
        first_name: 'Signer',
        last_name: '2',
        email: nextEmail,
        designation: 'Signer',
        order: 1
      }]
    })
  })
  const created = await createResp.json()
  const signingUrl = `https://app.firma.dev/signing/${created.recipients[0].id}`

  // Store the link in your own database
  await db.signingChains.insert({
    original_id: originalSigningRequestId,
    chained_id: created.id,
    created_at: new Date()
  })

  res.json({ signingUrl })
})

app.listen(3000)