Verificação de Assinatura

import crypto from "crypto"

function verifyWebhook(rawBody, signature, secret) {
  const parts = Object.fromEntries(
    signature.split(",").map(p => p.split("="))
  )
  const timestamp = parts["t"]
  const receivedHmac = parts["v1"]

  if (!timestamp || !receivedHmac) return false

  // Rejeita eventos com mais de 5 minutos (proteção contra replay)
  const age = Math.abs(Date.now() / 1000 - Number(timestamp))
  if (age > 300) return false

  const signedString = `${timestamp}.${rawBody}`
  const expected = crypto
    .createHmac("sha256", secret)
    .update(signedString)
    .digest("hex")

  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(receivedHmac)
  )
}

// Express / Next.js
app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const signature = req.headers["x-vistum-signature"] ?? ""
  const valid = verifyWebhook(req.body.toString(), signature, process.env.WEBHOOK_SECRET)

  if (!valid) return res.status(401).json({ error: "Invalid signature" })

  const event = JSON.parse(req.body)
  console.log("Evento recebido:", event.event)

  res.json({ ok: true })
})

import hashlib
import hmac
import time

def verify_webhook(raw_body: bytes, signature: str, secret: str) -> bool:
    parts = dict(p.split("=", 1) for p in signature.split(","))
    timestamp = parts.get("t")
    received_hmac = parts.get("v1")

    if not timestamp or not received_hmac:
        return False

    # Rejeita eventos com mais de 5 minutos
    age = abs(time.time() - float(timestamp))
    if age > 300:
        return False

    signed_string = f"{timestamp}.{raw_body.decode('utf-8')}"
    expected = hmac.new(
        secret.encode("utf-8"),
        signed_string.encode("utf-8"),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(expected, received_hmac)

# Flask
@app.route("/webhook", methods=["POST"])
def webhook():
    signature = request.headers.get("X-Vistum-Signature", "")
    if not verify_webhook(request.data, signature, os.environ["WEBHOOK_SECRET"]):
        return {"error": "Invalid signature"}, 401

    event = request.json
    print(f"Evento recebido: {event['event']}")
    return {"ok": True}

function verifyWebhook(string $rawBody, string $signature, string $secret): bool {
    $parts = [];
    foreach (explode(',', $signature) as $part) {
        [$key, $val] = explode('=', $part, 2);
        $parts[$key] = $val;
    }

    if (empty($parts['t']) || empty($parts['v1'])) return false;

    // Rejeita eventos com mais de 5 minutos
    if (abs(time() - (int)$parts['t']) > 300) return false;

    $signedString = $parts['t'] . '.' . $rawBody;
    $expected = hash_hmac('sha256', $signedString, $secret);

    return hash_equals($expected, $parts['v1']);
}