Webhooks

import crypto from "node:crypto";

// rawBody: the request body exactly as received (a string or Buffer)
export function verify(rawBody, header, secret) {
  if (typeof header !== "string") return false;
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > 5 * 60) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(expected);
  const b = Buffer.from(parts.v1 ?? "");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Express: read the body raw, so it is signed exactly as sent
// app.post("/webhooks/promptlab", express.raw({ type: "application/json" }), (req, res) => {
//   if (!verify(req.body, req.get("PromptLab-Signature"), process.env.PROMPTLAB_WEBHOOK_SECRET)) return res.sendStatus(400);
//   const event = JSON.parse(req.body);
//   res.sendStatus(200);
// });

import hashlib, hmac, time

# raw_body: the request body exactly as received (bytes)
def verify(raw_body: bytes, header: str, secret: str) -> bool:
    try:
        parts = dict(p.split("=", 1) for p in (header or "").split(","))
        t = int(parts.get("t", 0))
    except ValueError:
        return False
    if not t or abs(time.time() - t) > 5 * 60:
        return False

    signed = f"{t}.".encode() + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", ""))