Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

// Verifique sobre o corpo BRUTO da requisição, nunca sobre JSON re-serializado.
export function verify(secret: string, header: string, rawBody: Buffer) {
  const parts = Object.fromEntries(
    header.split(",").map((part) => part.trim().split("=", 2)),
  );
  const age = Math.abs(Math.floor(Date.now() / 1000) - Number(parts.t));
  if (!parts.t || !parts.v1 || Number.isNaN(age) || age > 300) return false;
  const expected = createHmac("sha256", secret)
    .update(`${parts.t}.`)
    .update(rawBody)
    .digest();
  const received = Buffer.from(parts.v1, "hex");
  return expected.length === received.length && timingSafeEqual(expected, received);
}

// Express: mantenha o corpo bruto no handler do webhook.
app.post("/webhooks/smskit", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.header("X-SMSKit-Signature") ?? "";
  if (!verify(process.env.SMSKIT_WEBHOOK_SECRET!, header, req.body)) {
    return res.status(400).end();
  }
  const event = JSON.parse(req.body.toString("utf8"));
  // event.type, event.data …
  res.status(204).end();
});

import hmac
import time
from hashlib import sha256


def verify(secret: str, header: str, body: bytes, tolerance: int = 300) -> bool:
    parts = dict(p.strip().partition("=")[::2] for p in header.split(","))
    stamp, sent = parts.get("t", ""), parts.get("v1", "")
    if not stamp.isdigit() or abs(int(time.time()) - int(stamp)) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{stamp}.".encode() + body, sha256).hexdigest()
    return hmac.compare_digest(sent.lower(), expected)


# FastAPI: use o corpo bruto, não o JSON já analisado.
@app.post("/webhooks/smskit", status_code=204)
async def webhook(request: Request):
    body = await request.body()
    if not verify(SECRET, request.headers.get("X-SMSKit-Signature", ""), body):
        raise HTTPException(status_code=400)
    event = json.loads(body)
    # event["type"], event["data"] …

import { verifySignature } from "smskit";

// Assíncrono: usa Web Crypto, funciona em Node, Bun, Deno e edge runtimes.
const ok = await verifySignature(
  process.env.SMSKIT_WEBHOOK_SECRET!,
  request.headers.get("X-SMSKit-Signature"),
  rawBody, // string ou Uint8Array com o corpo bruto
);
if (!ok) return new Response(null, { status: 400 });

from smskit import verify_signature

ok = verify_signature(
    SECRET,
    request.headers.get("X-SMSKit-Signature"),
    await request.body(),  # bytes do corpo bruto
)
if not ok:
    raise HTTPException(status_code=400)