Webhooks

import crypto from 'node:crypto';

function parseSignatureHeader(value) {
  const segments = value.split(',').map((part) => part.trim());
  if (!segments.includes('v1')) return null;

  const fields = Object.fromEntries(
    segments
      .filter((part) => part.includes('='))
      .map((part) => part.split('=', 2)),
  );

  if (!/^\d+$/.test(fields.t ?? '')) return null;
  if (!/^[0-9a-f]{64}$/i.test(fields.h ?? '')) return null;

  return { timestamp: fields.t, signature: fields.h.toLowerCase() };
}

export function verifyShoppexWebhook({
  rawBody,
  signatureHeader,
  deliveryId,
  timestampHeader,
  secret,
}) {
  const parsed = parseSignatureHeader(signatureHeader);
  if (!parsed || !deliveryId || parsed.timestamp !== timestampHeader) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${deliveryId}.${parsed.timestamp}.`, 'utf8')
    .update(rawBody)
    .digest();
  const received = Buffer.from(parsed.signature, 'hex');

  return received.length === expected.length
    && crypto.timingSafeEqual(received, expected);
}

<?php
function verifyShoppexWebhook(
    string $rawBody,
    string $signatureHeader,
    string $deliveryId,
    string $timestampHeader,
    string $secret
): bool {
    $segments = array_map('trim', explode(',', $signatureHeader));
    if (!in_array('v1', $segments, true)) {
        return false;
    }

    $fields = [];
    foreach ($segments as $segment) {
        if (str_contains($segment, '=')) {
            [$key, $value] = explode('=', $segment, 2);
            $fields[$key] = $value;
        }
    }

    $timestamp = $fields['t'] ?? '';
    $signature = strtolower($fields['h'] ?? '');
    if ($deliveryId === '' || $timestamp !== $timestampHeader) {
        return false;
    }
    if (!preg_match('/^[0-9a-f]{64}$/', $signature)) {
        return false;
    }

    $message = $deliveryId . '.' . $timestamp . '.' . $rawBody;
    $expected = hash_hmac('sha256', $message, $secret);

    return hash_equals($expected, $signature);
}

$rawBody = file_get_contents('php://input');

import hashlib
import hmac
import re


def verify_shoppex_webhook(
    raw_body: bytes,
    signature_header: str,
    delivery_id: str,
    timestamp_header: str,
    secret: str,
) -> bool:
    segments = [part.strip() for part in signature_header.split(",")]
    if "v1" not in segments:
        return False

    fields = dict(part.split("=", 1) for part in segments if "=" in part)
    timestamp = fields.get("t", "")
    signature = fields.get("h", "").lower()

    if not delivery_id or timestamp != timestamp_header:
        return False
    if re.fullmatch(r"[0-9a-f]{64}", signature) is None:
        return False

    prefix = f"{delivery_id}.{timestamp}.".encode("utf-8")
    expected = hmac.new(
        secret.encode("utf-8"),
        prefix + raw_body,
        hashlib.sha256,
    ).hexdigest()

    return hmac.compare_digest(expected, signature)