Webhook

import hashlib
import hmac
import re
import time

TOLERANCE_SECONDS = 300


def verify_webhook(
    secret: str, timestamp: str, raw_body: bytes, signature: str
) -> bool:
    if not isinstance(secret, str) or not secret:
        return False
    if not isinstance(raw_body, bytes):
        return False
    if not re.fullmatch(r"[0-9]{1,12}", timestamp or ""):
        return False
    if not re.fullmatch(r"sha256=[0-9a-f]{64}", signature or ""):
        return False
    if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        return False
    expected = "sha256=" + hmac.new(
        secret.encode("utf-8"),
        timestamp.encode("ascii") + b"." + raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

import { createHmac, timingSafeEqual } from "node:crypto";

const TOLERANCE_SECONDS = 300;
const TS_RE = /^[0-9]{1,12}$/;
const SIG_RE = /^sha256=[0-9a-f]{64}$/;

export function verifyWebhook(secret, timestamp, rawBody, signature) {
  if (typeof secret !== "string" || !secret) return false;
  if (!Buffer.isBuffer(rawBody)) return false;
  if (typeof timestamp !== "string" || !TS_RE.test(timestamp)) {
    return false;
  }
  if (typeof signature !== "string" || !SIG_RE.test(signature)) {
    return false;
  }
  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (age > TOLERANCE_SECONDS) return false;
  const expected =
    "sha256=" +
    createHmac("sha256", Buffer.from(secret, "utf8"))
      .update(timestamp + ".", "ascii")
      .update(rawBody)
      .digest("hex");
  return timingSafeEqual(Buffer.from(expected, "ascii"), Buffer.from(signature, "ascii"));
}

{
  "event": "creation.completed",
  "id": "test",
  "test": true
}