Webhooks

const crypto = require('node:crypto');

function verify(secret, rawBody, header, toleranceSec = 300) {
  const p = Object.fromEntries(header.split(',').map((kv) => kv.trim().split('=', 2)));
  const t = Number(p.t);
  if (!Number.isInteger(t) || !/^[0-9a-f]{64}$/.test(p.v1 ?? '')) return false;
  if (Math.abs(Date.now() / 1000 - t) > toleranceSec) return false;
  const expected = crypto.createHmac('sha256', secret).update(`${t}.`).update(rawBody).digest();
  return crypto.timingSafeEqual(expected, Buffer.from(p.v1, 'hex'));
}

// Express: app.post('/webhooks/mergen', express.raw({ type: 'application/json' }), handler)

import hashlib, hmac, time

def verify(secret: str, raw_body: bytes, header: str, tolerance_sec: int = 300) -> bool:
    p = dict(kv.strip().split("=", 1) for kv in header.split(",") if "=" in kv)
    try:
        t = int(p["t"])
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > tolerance_sec:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, p.get("v1", ""))