Webhooks

import hashlib
import hmac
import time

TOLERANCE_SECONDS = 300


def verify_marky_webhook(secret: str, raw_body: bytes, timestamp: str, signature: str) -> bool:
    if not (timestamp.isascii() and timestamp.isdigit()) or abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        return False

    signed = f"{timestamp}.".encode() + raw_body
    expected = "sha256=" + hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)


# Flask example
# @app.post("/webhook")
# def webhook():
#     ok = verify_marky_webhook(
#         SECRET,
#         request.get_data(),  # raw bytes, not request.json
#         request.headers["X-Marky-Timestamp"],
#         request.headers["X-Marky-Signature"],
#     )
#     if not ok:
#         abort(400)

import crypto from "node:crypto";

const TOLERANCE_SECONDS = 300;

export function verifyMarkyWebhook(secret, rawBody, timestamp, signature) {
  if (!/^\d+$/.test(timestamp)) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > TOLERANCE_SECONDS) return false;

  const expected =
    "sha256=" +
    crypto
      .createHmac("sha256", secret)
      .update(`${timestamp}.`)
      .update(rawBody) // a Buffer of the raw body, e.g. express.raw({ type: "application/json" })
      .digest("hex");

  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}