Assinatura dos webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyWabox(secret, header, rawBody, toleranceSec = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > toleranceSec) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest();
  const given = Buffer.from(parts.v1 ?? "", "hex");
  return given.length === expected.length && timingSafeEqual(given, expected);
}

// Express: use o corpo cru na rota do webhook
app.post("/wabox", express.raw({ type: "application/json" }), (req, res) => {
  if (!verifyWabox(process.env.WABOX_WEBHOOK_SECRET, req.get("X-Wabox-Signature") ?? "", req.body.toString("utf8"))) {
    return res.status(401).end();
  }
  const event = JSON.parse(req.body);
  res.status(200).end(); // responda antes de processar
  handle(event);
});

import hashlib, hmac, time

def verify_wabox(secret: str, header: str, raw_body: bytes, tolerance: int = 300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    try:
        t = int(parts["t"])
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", ""))

# FastAPI
@app.post("/wabox")
async def wabox(request: Request):
    raw = await request.body()
    if not verify_wabox(SECRET, request.headers.get("X-Wabox-Signature", ""), raw):
        raise HTTPException(401)
    event = json.loads(raw)
    background.add_task(handle, event)
    return {"ok": True}

function verifyWabox(string $secret, string $header, string $rawBody, int $tolerance = 300): bool {
    $parts = [];
    foreach (explode(',', $header) as $p) {
        [$k, $v] = array_pad(explode('=', $p, 2), 2, '');
        $parts[trim($k)] = trim($v);
    }
    $t = (int) ($parts['t'] ?? 0);
    if ($t === 0 || abs(time() - $t) > $tolerance) return false;
    $expected = hash_hmac('sha256', $t . '.' . $rawBody, $secret);
    return hash_equals($expected, $parts['v1'] ?? '');
}

$raw = file_get_contents('php://input');
if (!verifyWabox(getenv('WABOX_WEBHOOK_SECRET'), $_SERVER['HTTP_X_WABOX_SIGNATURE'] ?? '', $raw)) {
    http_response_code(401);
    exit;
}
http_response_code(200);
$event = json_decode($raw, true);