Webhooks

import crypto from 'node:crypto';

function verify(rawBody: string, header: string, secret: string): boolean {
  const parts = Object.fromEntries(
    header.split(',').map((p) => p.split('=', 2) as [string, string]),
  );
  const ts = Number(parts.t);
  const sig = parts.v1;
  if (!ts || !sig) return false;

  // Reject events older than 5 minutes (replay protection)
  if (Math.abs(Date.now() / 1000 - ts) > 300) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${ts}.${rawBody}`)
    .digest('hex');

  return crypto.timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(sig, 'hex'));
}

// Express handler
app.post('/webhooks/rimp', express.raw({ type: 'application/json' }), (req, res) => {
  const ok = verify(
    req.body.toString('utf8'),
    req.headers['x-rimp-signature'] as string,
    process.env.RIMP_WEBHOOK_SECRET!,
  );
  if (!ok) return res.status(401).end();

  const event = JSON.parse(req.body.toString('utf8'));
  // ... handle event
  res.status(204).end();
});

import hmac, hashlib, time
from fastapi import Request, HTTPException

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    parts = dict(part.split('=', 1) for part in header.split(','))
    ts = int(parts.get('t', 0))
    sig = parts.get('v1', '')
    if not ts or not sig: return False
    if abs(time.time() - ts) > 300: return False
    expected = hmac.new(
        secret.encode(), f"{ts}.{raw_body.decode()}".encode(), hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, sig)

@app.post("/webhooks/rimp")
async def handler(req: Request):
    raw = await req.body()
    sig = req.headers.get("x-rimp-signature", "")
    if not verify(raw, sig, os.environ["RIMP_WEBHOOK_SECRET"]):
        raise HTTPException(401)
    event = await req.json()
    # ... handle event