Webhooks

import { createHmac, timingSafeEqual } from 'node:crypto';

function verifyGenieOsWebhook(opts: {
  rawBody: Buffer | string;
  signatureHeader: string;
  secret: string;
  toleranceSec?: number;
}) {
  const tolerance = opts.toleranceSec ?? 300;
  const match = /^t=(\d+),v1=([0-9a-f]+)$/i.exec(opts.signatureHeader);
  if (!match) throw new Error('bad_signature_header');
  const t = Number(match[1]);
  const v1 = match[2]!;
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > tolerance) {
    throw new Error('timestamp_out_of_tolerance');
  }
  const body = typeof opts.rawBody === 'string' ? opts.rawBody : opts.rawBody.toString('utf8');
  const expected = createHmac('sha256', opts.secret).update(`${t}.${body}`).digest('hex');
  const a = Buffer.from(v1, 'utf8');
  const b = Buffer.from(expected, 'utf8');
  if (a.length !== b.length || !timingSafeEqual(a, b)) throw new Error('bad_signature');
  return JSON.parse(body);
}

import hmac, hashlib, time, json

def verify_genieos_webhook(raw_body: bytes, signature_header: str, secret: str, tolerance=300):
    # X-GenieOS-Signature: t=<unix>,v1=<hex>
    parts = dict(p.split("=", 1) for p in signature_header.split(","))
    t = int(parts["t"])
    v1 = parts["v1"]
    if abs(int(time.time()) - t) > tolerance:
        raise ValueError("timestamp_out_of_tolerance")
    expected = hmac.new(
        secret.encode(), f"{t}.{raw_body.decode()}".encode(), hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(v1, expected):
        raise ValueError("bad_signature")
    return json.loads(raw_body)

// Parse X-GenieOS-Signature as t=<unix>,v1=<hex>,
// HMAC-SHA256 secret over fmt.Sprintf("%d.%s", t, rawBody),
// compare with hmac.Equal, reject |now-t| > 300s.

# Same Stripe-style envelope: sign "#{t}.#{raw_body}" with the secret.

// Same Stripe-style envelope: hash_hmac('sha256', "$t.$rawBody", $secret).