Вебхуки

import hashlib, hmac, re, time

TOLERANCE_SECONDS = 300

def verify_webhook(secret: str, timestamp: str, raw_body: bytes, signature: str) -> bool:
    if not secret or not isinstance(raw_body, bytes):
        return False
    if not re.fullmatch(r"[0-9]{1,12}", timestamp or ""):
        return False
    if not re.fullmatch(r"sha256=[0-9a-f]{64}", signature or ""):
        return False
    if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        return False
    expected = "sha256=" + hmac.new(
        secret.encode("utf-8"),
        timestamp.encode("ascii") + b"." + raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

import { createHmac, timingSafeEqual } from "node:crypto";

const TOLERANCE_SECONDS = 300;

function verifyWebhook(secret, timestamp, rawBody, signature) {
  if (!secret || !Buffer.isBuffer(rawBody)) return false;
  if (!/^[0-9]{1,12}$/.test(timestamp)) return false;
  if (!/^sha256=[0-9a-f]{64}$/.test(signature)) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > TOLERANCE_SECONDS) return false;
  const expected = "sha256=" + createHmac("sha256", Buffer.from(secret, "utf8"))
    .update(timestamp + ".", "ascii")
    .update(rawBody)
    .digest("hex");
  return timingSafeEqual(Buffer.from(expected, "ascii"), Buffer.from(signature, "ascii"));
}