Gérer les webhooks

import crypto from 'node:crypto';

const TOLERANCE_SECONDS = 300;

export function isAuthentic(rawBody, signatureHeader, secret) {
  const parts = (signatureHeader ?? '').split(',').map((part) => part.split('='));
  const timestamp = Number(parts.find(([key]) => key === 't')?.[1]);
  const signatures = parts.filter(([key]) => key === 'v1').map(([, value]) => value);

  if (!timestamp || Math.abs(Date.now() / 1000 - timestamp) > TOLERANCE_SECONDS) {
    return false;
  }

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  return signatures.some(
    (signature) =>
      signature.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature)),
  );
}

function isAuthentic(string $rawBody, ?string $signatureHeader, string $secret): bool
{
    $timestamp = null;
    $signatures = [];

    foreach (explode(',', $signatureHeader ?? '') as $part) {
        [$key, $value] = array_pad(explode('=', trim($part), 2), 2, '');

        if ($key === 't') {
            $timestamp = (int) $value;
        } elseif ($key === 'v1') {
            $signatures[] = $value;
        }
    }

    if (! $timestamp || abs(time() - $timestamp) > 300) {
        return false;
    }

    $expected = hash_hmac('sha256', $timestamp.'.'.$rawBody, $secret);

    foreach ($signatures as $signature) {
        if (hash_equals($expected, $signature)) {
            return true;
        }
    }

    return false;
}

import hashlib
import hmac
import time


def is_authentic(raw_body: bytes, signature_header: str | None, secret: str) -> bool:
    timestamp = None
    signatures = []

    for part in (signature_header or '').split(','):
        key, _, value = part.strip().partition('=')
        if key == 't' and value.isdigit():
            timestamp = int(value)
        elif key == 'v1':
            signatures.append(value)

    if timestamp is None or abs(time.time() - timestamp) > 300:
        return False

    signed = f'{timestamp}.'.encode() + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()

    return any(hmac.compare_digest(expected, signature) for signature in signatures)