軽量なWebhookとしてのHTTPSエンドポイント

What Are Atlas HTTPS Endpoints?

Creating an HTTPS Endpoint

// The HTTPS endpoint URL format:
// https://data.mongodb-api.com/app/{APP_ID}/endpoint{route}

// Example endpoint configuration:
// Route: /webhook/stripe
// HTTP Method: POST
// Auth: no auth (Stripe handles its own signature)
// Function: handleStripeWebhook

The Request Object

exports = async function(request) {
  // Access headers, query params, and body
  const contentType = request.headers['Content-Type']
  const page = parseInt(request.query.page) || 1
  const bodyText = request.body.text()
  const payload = EJSON.parse(bodyText)

  console.log('Received ' + request.httpMethod + ' with page=' + page)
  console.log('Body:', JSON.stringify(payload))
}

Returning a Response

exports = async function(request) {
  // Simple JSON response (200 OK)
  return { success: true, data: [1, 2, 3] }

  // Custom status code and headers
  // return {
  //   statusCode: 201,
  //   headers: { 'X-Request-Id': ['abc123'] },
  //   body: JSON.stringify({ id: newDoc._id })
  // }

  // Error response
  // return {
  //   statusCode: 400,
  //   body: JSON.stringify({ error: 'Missing required field: email' })
  // }
}

Webhook Signature Validation

exports = async function(request) {
  // Validate Stripe webhook signature
  const sigHeader = request.headers['Stripe-Signature'][0]
  const bodyText = request.body.text()
  const webhookSecret = context.values.get('STRIPE_WEBHOOK_SECRET')

  // Compute expected signature (simplified — use a library in real code)
  const crypto = require('crypto')
  const timestamp = sigHeader.split(',').find(p => p.startsWith('t=')).split('=')[1]
  const expectedSig = crypto
    .createHmac('sha256', webhookSecret)
    .update(timestamp + '.' + bodyText)
    .digest('hex')
  const receivedSig = sigHeader.split(',').find(p => p.startsWith('v1=')).split('=')[1]

  if (receivedSig !== expectedSig) {
    return { statusCode: 401, body: JSON.stringify({ error: 'Invalid signature' }) }
  }

  // Safe to process
  const event = EJSON.parse(bodyText)
  // ...
}

Authentication Options

// Calling a user-authenticated endpoint from a client app
const response = await fetch(
  'https://data.mongodb-api.com/app/APP_ID/endpoint/api/profile',
  {
    method: 'GET',
    headers: {
      'Authorization': 'Bearer ' + userJwtToken,
      'Content-Type': 'application/json'
    }
  }
)
const data = await response.json()

Building a Lightweight REST API

// Single ANY-method endpoint handles multiple routes
exports = async function(request) {
  const db = context.services.get('mongodb-atlas').db('mydb')
  const path = request.rawUrl.split('/endpoint')[1]  // e.g., '/api/orders'

  if (request.httpMethod === 'GET' && path === '/api/orders') {
    const orders = await db.collection('orders').find({}).limit(20).toArray()
    return { statusCode: 200, body: EJSON.stringify(orders) }
  }

  if (request.httpMethod === 'POST' && path === '/api/orders') {
    const body = EJSON.parse(request.body.text())
    const result = await db.collection('orders').insertOne(body)
    return { statusCode: 201, body: JSON.stringify({ id: result.insertedId }) }
  }

  return { statusCode: 404, body: JSON.stringify({ error: 'Not found' }) }
}

Idempotency for Webhook Receivers

exports = async function(request) {
  const event = EJSON.parse(request.body.text())
  const db = context.services.get('mongodb-atlas').db('mydb')

  // Idempotency check: has this event been processed?
  const existing = await db.collection('processed_events').findOne({ _id: event.id })
  if (existing) {
    return { statusCode: 200, body: JSON.stringify({ status: 'already_processed' }) }
  }

  // Process the event
  await handleEvent(db, event)

  // Mark as processed (atomic upsert)
  await db.collection('processed_events').updateOne(
    { _id: event.id },
    { $set: { processedAt: new Date(), type: event.type } },
    { upsert: true }
  )

  return { statusCode: 200, body: JSON.stringify({ status: 'ok' }) }
}

CORS and Browser Access

// Manual CORS headers if you need custom control
exports = async function(request) {
  const corsHeaders = {
    'Access-Control-Allow-Origin': ['https://myapp.com'],
    'Access-Control-Allow-Methods': ['GET, POST, OPTIONS'],
    'Access-Control-Allow-Headers': ['Content-Type, Authorization']
  }

  // Handle preflight
  if (request.httpMethod === 'OPTIONS') {
    return { statusCode: 204, headers: corsHeaders, body: '' }
  }

  // Handle actual request
  const data = await getData()
  return { statusCode: 200, headers: corsHeaders,
    body: JSON.stringify(data) }
}

Rate Limiting and Abuse Prevention

// Simple IP-based rate limiting
exports = async function(request) {
  const ip = request.headers['X-Forwarded-For'][0]
  const db = context.services.get('mongodb-atlas').db('mydb')
  const windowMs = 60 * 1000  // 1 minute
  const maxRequests = 30

  const now = Date.now()
  const record = await db.collection('rate_limits').findOneAndUpdate(
    { _id: ip, resetAt: { $gt: new Date(now) } },
    { $inc: { count: 1 }, $setOnInsert: { resetAt: new Date(now + windowMs) } },
    { upsert: true, returnDocument: 'after' }
  )

  if (record && record.count > maxRequests) {
    return { statusCode: 429, body: JSON.stringify({ error: 'Rate limit exceeded' }) }
  }
  // Proceed...
}

Logging and Debugging Endpoints

exports = async function(request) {
  const start = Date.now()
  const route = request.httpMethod + ' ' + request.rawUrl.split('/endpoint')[1]
  try {
    const result = await handleRequest(request)
    console.log(JSON.stringify({ route, status: result.statusCode || 200, ms: Date.now() - start }))
    return result
  } catch (err) {
    console.error(JSON.stringify({ route, status: 500, error: err.message, ms: Date.now() - start }))
    return { statusCode: 500, body: JSON.stringify({ error: 'Internal server error' }) }
  }
}

Quick Check

Lesson Recap