Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyEverbilityWebhook(
  rawBody: Buffer,
  headers: Record<string, string | undefined>,
  webhookSecret: string,
  now = Math.floor(Date.now() / 1000),
): boolean {
  const timestamp = headers["everbility-webhook-timestamp"];
  const signatureHeader = headers["everbility-webhook-signature"];

  if (!timestamp || !/^\d+$/.test(timestamp)) return false;
  if (Math.abs(now - Number(timestamp)) > 300) return false;

  const signatureMatch = /^v1=([0-9a-f]{64})$/.exec(signatureHeader ?? "");
  if (!signatureMatch) return false;

  const expected = createHmac("sha256", webhookSecret)
    .update(`${timestamp}.`, "ascii")
    .update(rawBody)
    .digest();
  const supplied = Buffer.from(signatureMatch[1], "hex");

  return timingSafeEqual(expected, supplied);
}

import hashlib
import hmac
import re
import time
from collections.abc import Mapping


def verify_everbility_webhook(
    raw_body: bytes,
    headers: Mapping[str, str],
    webhook_secret: str,
    now: int | None = None,
) -> bool:
    timestamp = headers.get("Everbility-Webhook-Timestamp", "")
    signature_header = headers.get("Everbility-Webhook-Signature", "")

    if not timestamp.isdigit():
        return False
    current_time = int(time.time()) if now is None else now
    if abs(current_time - int(timestamp)) > 300:
        return False

    match = re.fullmatch(r"v1=([0-9a-f]{64})", signature_header)
    if match is None:
        return False

    expected = hmac.new(
        webhook_secret.encode("utf-8"),
        timestamp.encode("ascii") + b"." + raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, match.group(1))