Webhooks

import crypto from "node:crypto";

function verify(req, rawBody, secret) {
  const header = req.headers["x-consentfly-signature"];
  if (!header) return false;
  const parts = Object.fromEntries(
    header.split(",").map((kv) => kv.split("="))
  );
  if (!parts.t || !parts.v1) return false;

  // Rejeite deliveries com mais de ~5 min de skew para mitigar replay.
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - Number(parts.t)) > 300) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${parts.t}.${rawBody}`)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(parts.v1, "hex")
  );
}

import hmac, hashlib, time

def verify(headers: dict, raw_body: bytes, secret: str) -> bool:
    header = headers.get("X-ConsentFly-Signature")
    if not header:
        return False
    parts = dict(kv.split("=", 1) for kv in header.split(","))
    t, v1 = parts.get("t"), parts.get("v1")
    if not t or not v1:
        return False

    # Rejeite deliveries com mais de ~5 min de skew para mitigar replay.
    if abs(int(time.time()) - int(t)) > 300:
        return False

    payload = f"{t}.".encode() + raw_body
    expected = hmac.new(secret.encode(), payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

package webhook

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "strconv"
    "strings"
    "time"
)

func Verify(header string, rawBody []byte, secret string) bool {
    parts := map[string]string{}
    for _, kv := range strings.Split(header, ",") {
        if idx := strings.IndexByte(kv, '='); idx > 0 {
            parts[kv[:idx]] = kv[idx+1:]
        }
    }
    t, v1 := parts["t"], parts["v1"]
    if t == "" || v1 == "" {
        return false
    }

    // Rejeite deliveries com mais de ~5 min de skew para mitigar replay.
    ts, _ := strconv.ParseInt(t, 10, 64)
    if abs(time.Now().Unix()-ts) > 300 {
        return false
    }

    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(t + "."))
    mac.Write(rawBody)
    expected := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(expected), []byte(v1))
}

func abs(n int64) int64 {
    if n < 0 {
        return -n
    }
    return n
}