Webhooks

import { createHmac, timingSafeEqual } from 'node:crypto';

const SECRET = Buffer.from(process.env.WEBHOOK_SECRET.replace(/^whsec_/, ''), 'base64');
const TOLERANCE_SECONDS = 5 * 60;

// `rawBody` is the request body as bytes: read it before any JSON middleware runs.
export function verify(headers, rawBody) {
  const id = headers['svix-id'] ?? headers['webhook-id'];
  const timestamp = headers['svix-timestamp'] ?? headers['webhook-timestamp'];
  const signatures = headers['svix-signature'] ?? headers['webhook-signature'];
  if (!id || !timestamp || !signatures) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > TOLERANCE_SECONDS) return false;

  const expected = createHmac('sha256', SECRET)
    .update(`${id}.${timestamp}.`)
    .update(rawBody)
    .digest();
  return signatures.split(' ').some((entry) => {
    const [version, value] = entry.split(',');
    if (version !== 'v1' || !value) return false;
    const given = Buffer.from(value, 'base64');
    return given.length === expected.length && timingSafeEqual(given, expected);
  });
}

import base64, hmac, hashlib, os, time

SECRET = base64.b64decode(os.environ["WEBHOOK_SECRET"].removeprefix("whsec_"))
TOLERANCE_SECONDS = 5 * 60


def verify(headers: dict, raw_body: bytes) -> bool:
    """`raw_body` is the request body as received, before any JSON parsing."""
    h = {k.lower(): v for k, v in headers.items()}
    msg_id = h.get("svix-id") or h.get("webhook-id")
    timestamp = h.get("svix-timestamp") or h.get("webhook-timestamp")
    signatures = h.get("svix-signature") or h.get("webhook-signature")
    if not (msg_id and timestamp and signatures):
        return False
    if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        return False
    expected = hmac.new(SECRET, f"{msg_id}.{timestamp}.".encode() + raw_body, hashlib.sha256).digest()
    for entry in signatures.split(" "):
        version, _, value = entry.partition(",")
        if version == "v1" and value and hmac.compare_digest(base64.b64decode(value), expected):
            return True
    return False