Connect ComplianceLayer to ConnectWise Manage

# bridge.py — receives ComplianceLayer webhooks,
# creates ConnectWise Manage service tickets

from fastapi import FastAPI, Request, HTTPException
import httpx, hashlib, hmac, os

app = FastAPI()

CW_URL    = os.environ["CW_URL"]       # e.g. https://na.myconnectwise.net/v4_6_release/apis/3.0
CW_COMPANY = os.environ["CW_COMPANY"]
CW_PUBLIC  = os.environ["CW_PUBLIC_KEY"]
CW_PRIVATE = os.environ["CW_PRIVATE_KEY"]
CW_BOARD_ID = int(os.environ.get("CW_BOARD_ID", "1"))
WEBHOOK_SECRET = os.environ["WEBHOOK_SECRET"]

SEVERITY_MAP = {
    "critical": {"id": 1, "name": "Priority 1 - Critical"},
    "high":     {"id": 2, "name": "Priority 2 - High"},
    "medium":   {"id": 3, "name": "Priority 3 - Medium"},
    "low":      {"id": 4, "name": "Priority 4 - Low"},
}

@app.post("/webhook/compliancelayer")
async def handle_webhook(request: Request):
    body = await request.body()
    signature = request.headers.get("X-Webhook-Signature", "")
    expected = hmac.new(
        WEBHOOK_SECRET.encode(), body, hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        raise HTTPException(401, "Invalid signature")

    payload = await request.json()
    domain  = payload["domain"]
    grade   = payload["grade"]

    for finding in payload.get("findings", []):
        severity = finding.get("severity", "low")
        if severity not in ("critical", "high"):
            continue

        await create_ticket(
            summary=f"[{grade}] {domain}: {finding['title']}",
            body=build_ticket_body(domain, grade, finding),
            priority=SEVERITY_MAP[severity],
        )

    return {"status": "ok"}

# bridge.ps1 — PowerShell alternative for Windows MSPs
$webhookBody = Get-Content -Raw -Path $args[0] | ConvertFrom-Json

$cwUrl     = $env:CW_URL
$company   = $env:CW_COMPANY
$publicKey = $env:CW_PUBLIC_KEY
$privateKey = $env:CW_PRIVATE_KEY

$auth = [Convert]::ToBase64String(
  [Text.Encoding]::ASCII.GetBytes(
    "$company+$publicKey:$privateKey"
  )
)

foreach ($finding in $webhookBody.findings) {
  if ($finding.severity -notin @("critical","high")) { continue }

  $ticket = @{
    summary = "[$($webhookBody.grade)] $($webhookBody.domain): $($finding.title)"
    board   = @{ id = $env:CW_BOARD_ID }
    priority = @{
      id = switch ($finding.severity) {
        "critical" { 1 } "high" { 2 }
      }
    }
    initialDescription = @"
Domain: $($webhookBody.domain)
Grade: $($webhookBody.grade)
Finding: $($finding.title)
Severity: $($finding.severity)

Remediation:
$($finding.remediation)
"@
  } | ConvertTo-Json -Depth 5

  Invoke-RestMethod -Uri "$cwUrl/service/tickets" \
    -Method Post -Body $ticket \
    -ContentType "application/json" \
    -Headers @{ Authorization = "Basic $auth" }
}