Webhooks

import crypto from 'node:crypto'

function verifyInkrSignature(rawBody, header, secret) {
  const parts = Object.fromEntries(
    header.split(',').map((kv) => kv.split('=')),
  )
  const timestamp = parts.t
  const signature = parts.v1

  const payload = `${timestamp}.${rawBody}`
  const expected = crypto.createHmac('sha256', secret).update(payload).digest('hex')

  // Constant-time comparison
  const sigBuf = Buffer.from(signature, 'hex')
  const expBuf = Buffer.from(expected, 'hex')
  if (sigBuf.length !== expBuf.length) return false
  return crypto.timingSafeEqual(sigBuf, expBuf)
}

// Tolérance horloge 5 minutes pour rejeter les replays
function isFreshTimestamp(header, maxAgeSeconds = 300) {
  const t = parseInt(header.split(',')[0].split('=')[1], 10)
  return Math.abs(Date.now() / 1000 - t) < maxAgeSeconds
}

import hashlib
import hmac
import time

def verify_inkr_signature(raw_body: bytes, header: str, secret: str) -> bool:
    parts = dict(kv.split('=', 1) for kv in header.split(','))
    timestamp = parts['t']
    signature = parts['v1']

    payload = f'{timestamp}.{raw_body.decode()}'.encode()
    expected = hmac.new(secret.encode(), payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(signature, expected)

def is_fresh_timestamp(header: str, max_age_seconds: int = 300) -> bool:
    t = int(header.split(',')[0].split('=')[1])
    return abs(time.time() - t) < max_age_seconds

require 'openssl'

def verify_inkr_signature(raw_body, header, secret)
  parts = header.split(',').to_h { |kv| kv.split('=', 2) }
  timestamp = parts['t']
  signature = parts['v1']

  payload = "#{timestamp}.#{raw_body}"
  expected = OpenSSL::HMAC.hexdigest('SHA256', secret, payload)
  Rack::Utils.secure_compare(signature, expected)
end

def fresh_timestamp?(header, max_age_seconds = 300)
  t = header.split(',').first.split('=', 2).last.to_i
  (Time.now.to_i - t).abs < max_age_seconds
end