Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyTotalisWebhook(
  secret: string,
  signatureHeader: string,
  rawBody: string | Buffer, // express.raw() gives a Buffer; both are fine
  toleranceSec = 300,
): boolean {
  const fields = new Map<string, string>();
  for (const part of signatureHeader.split(",")) {
    const i = part.indexOf("=");
    if (i !== -1) fields.set(part.slice(0, i), part.slice(i + 1));
  }
  const t = Number(fields.get("t"));
  const v1 = fields.get("v1");
  if (!Number.isFinite(t) || !v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > toleranceSec) return false;

  // Chained .update() signs "<t>." then the raw body bytes, with no string coercion.
  const expected = createHmac("sha256", secret).update(`${t}.`).update(rawBody).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(v1);
  return a.length === b.length && timingSafeEqual(a, b);
}

// Express: capture the raw body so you can sign over the exact bytes.
// app.use("/totalis/webhooks", express.raw({ type: "application/json" }));

import hmac, hashlib, time

def verify_totalis_webhook(secret: str, signature_header: str, raw_body: bytes, tolerance_sec: int = 300) -> bool:
    fields = dict(p.split("=", 1) for p in signature_header.split(",") if "=" in p)
    t, v1 = fields.get("t"), fields.get("v1")
    if not t or not v1:
        return False
    if abs(time.time() - int(t)) > tolerance_sec:
        return False
    signed = f"{t}.".encode() + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

# Flask: use request.get_data() for the raw body, not request.json.