Webhooks

import crypto from 'node:crypto'

function verifyInkrSignature(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(
    header.split(',').map((kv) => {
      const i = kv.indexOf('=')
      return [kv.slice(0, i).trim(), kv.slice(i + 1).trim()]
    }),
  )

  const timestamp = Number.parseInt(parts.t, 10)
  const signature = parts.v1
  if (!Number.isFinite(timestamp) || !/^[0-9a-f]{64}$/.test(signature)) return false

  // Anti-rejeu : refuser les timestamps trop anciens.
  const now = Math.floor(Date.now() / 1000)
  if (Math.abs(now - timestamp) > toleranceSeconds) return false

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`, 'utf8')
    .digest('hex')

  return crypto.timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(signature, 'hex'),
  )
}

import hashlib
import hmac
import re
import time

def verify_inkr_signature(raw_body: bytes, header: str, secret: str,
                          tolerance_seconds: int = 300) -> bool:
    parts = dict(kv.split('=', 1) for kv in header.split(','))
    try:
        timestamp = int(parts['t'].strip())
    except (KeyError, ValueError):
        return False

    signature = parts.get('v1', '').strip()
    if not re.fullmatch(r'[0-9a-f]{64}', signature):
        return False

    # Anti-rejeu : refuser les timestamps trop anciens.
    if abs(time.time() - timestamp) > tolerance_seconds:
        return False

    payload = f'{timestamp}.'.encode() + raw_body
    expected = hmac.new(secret.encode(), payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(signature, expected)

require 'openssl'

def verify_inkr_signature(raw_body, header, secret, tolerance_seconds = 300)
  parts = header.split(',').to_h { |kv| kv.split('=', 2).map(&:strip) }
  timestamp = Integer(parts['t'], exception: false)
  signature = parts['v1'].to_s
  return false unless timestamp && signature.match?(/\A[0-9a-f]{64}\z/)

  # Anti-rejeu : refuser les timestamps trop anciens.
  return false if (Time.now.to_i - timestamp).abs > tolerance_seconds

  expected = OpenSSL::HMAC.hexdigest('SHA256', secret, "#{timestamp}.#{raw_body}")
  OpenSSL.secure_compare(expected, signature)
end