About webhooks

import hashlib
import hmac
import time


def verify_valendata(secret: str, timestamp: str, raw_body: bytes, signature: str, tolerance_s: int = 300) -> bool:
    try:
        ts = int(timestamp)
    except (TypeError, ValueError):
        return False
    if abs(int(time.time()) - ts) > tolerance_s:
        return False
    digest = hmac.new(secret.encode(), f"{ts}.".encode() + raw_body, hashlib.sha256).hexdigest()
    expected = f"v1={digest}"
    return any(hmac.compare_digest(expected, s.strip()) for s in (signature or "").split(","))


# Flask:
# @app.post("/hooks/valendata")
# def hook():
#     if not verify_valendata(SECRET, request.headers.get("X-Valendata-Timestamp"),
#                             request.get_data(), request.headers.get("X-Valendata-Signature")):
#         abort(401)
#     run = request.get_json()
#     return "", 204

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyValendata(
  secret: string,
  timestamp: string | null,
  rawBody: Buffer,
  signature: string | null,
  toleranceS = 300,
): boolean {
  const ts = Number(timestamp);
  if (!Number.isInteger(ts) || !signature) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - ts) > toleranceS) return false;
  const digest = createHmac("sha256", secret)
    .update(Buffer.concat([Buffer.from(`${ts}.`), rawBody]))
    .digest("hex");
  const expected = Buffer.from(`v1=${digest}`);
  return signature.split(",").some((value) => {
    const given = Buffer.from(value.trim());
    return expected.length === given.length && timingSafeEqual(expected, given);
  });
}

// Express: use express.raw() so you get the exact bytes that were signed.
// app.post("/hooks/valendata", express.raw({ type: "application/json" }), (req, res) => {
//   if (!verifyValendata(SECRET, req.get("X-Valendata-Timestamp") ?? null, req.body,
//                        req.get("X-Valendata-Signature") ?? null)) return res.sendStatus(401);
//   const run = JSON.parse(req.body.toString("utf8"));
//   res.sendStatus(204);
// });