Webhooks

import hashlib
import hmac
import time

WEBHOOK_SECRET = "..."  # from your secret manager
TOLERANCE_SECONDS = 300

def verify_webhook(raw_body: bytes, signature_header: str | None) -> bool:
    if not signature_header:
        return False
    parts = dict(p.split("=", 1) for p in signature_header.split(",") if "=" in p)
    try:
        t = int(parts["t"])
        v1 = parts["v1"]
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > TOLERANCE_SECONDS:
        return False
    expected = hmac.new(
        WEBHOOK_SECRET.encode(), f"{t}.".encode() + raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, v1)

# FastAPI example: read the raw body, verify, then parse.
# raw = await request.body()
# if not verify_webhook(raw, request.headers.get("X-Winam-Signature")):
#     raise HTTPException(status_code=401)
# event = json.loads(raw)

const crypto = require('crypto');

const WEBHOOK_SECRET = process.env.WINAM_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 300;

function verifyWebhook(rawBody, signatureHeader) {
  if (!signatureHeader) return false;
  const parts = Object.fromEntries(
    signatureHeader.split(',').map((p) => {
      const i = p.indexOf('=');
      return [p.slice(0, i), p.slice(i + 1)];
    })
  );
  const t = parseInt(parts.t, 10);
  const v1 = parts.v1;
  if (!Number.isFinite(t) || !v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > TOLERANCE_SECONDS) return false;

  const expected = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(`${t}.`)
    .update(rawBody) // Buffer with the exact received bytes
    .digest('hex');
  const a = Buffer.from(expected, 'hex');
  const b = Buffer.from(v1, 'hex');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Express example: keep the raw body for this route.
// app.post('/winam/webhook', express.raw({ type: 'application/json' }), (req, res) => {
//   if (!verifyWebhook(req.body, req.get('X-Winam-Signature'))) return res.sendStatus(401);
//   const event = JSON.parse(req.body);
//   ...
//   res.sendStatus(200);
// });