Webhooks

import { createHmac, timingSafeEqual } from "node:crypto"
import { createServer } from "node:http"

const MAX_AGE_SECONDS = 300

export function verifyExyWebhook(rawBody, headers, secret) {
  const timestamp = headers["x-exy-timestamp"]
  const signature = headers["x-exy-signature"]
  if (typeof timestamp !== "string" || typeof signature !== "string") return false

  const age = Math.abs(Date.now() / 1000 - Number(timestamp))
  if (!Number.isFinite(age) || age > MAX_AGE_SECONDS) return false

  const expected =
    "v1=" + createHmac("sha256", secret).update(`${timestamp}.`).update(rawBody).digest("hex")
  const a = Buffer.from(signature)
  const b = Buffer.from(expected)
  return a.length === b.length && timingSafeEqual(a, b)
}

createServer((req, res) => {
  const chunks = []
  req.on("data", (chunk) => chunks.push(chunk))
  req.on("end", async () => {
    const rawBody = Buffer.concat(chunks)
    if (!verifyExyWebhook(rawBody, req.headers, process.env.EXY_WEBHOOK_SECRET)) {
      res.writeHead(401).end()
      return
    }
    try {
      const event = JSON.parse(rawBody.toString("utf8"))
      // Your own durable store or queue; skip the event if you have seen event.id before.
      await saveEvent(event)
      res.writeHead(204).end()
    } catch {
      res.writeHead(500).end() // Not stored, so we send it again.
    }
  })
}).listen(8080)

<?php
function exy_verify_webhook(string $rawBody, ?string $timestamp, ?string $signature, string $secret): bool
{
    if ($timestamp === null || $signature === null || !ctype_digit($timestamp)) {
        return false;
    }
    if (abs(time() - (int) $timestamp) > 300) {
        return false;
    }
    $expected = 'v1=' . hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    return hash_equals($expected, $signature);
}

$rawBody = file_get_contents('php://input');
$valid = exy_verify_webhook(
    $rawBody,
    $_SERVER['HTTP_X_EXY_TIMESTAMP'] ?? null,
    $_SERVER['HTTP_X_EXY_SIGNATURE'] ?? null,
    getenv('EXY_WEBHOOK_SECRET')
);
if (!$valid) {
    http_response_code(401);
    exit;
}
$event = json_decode($rawBody, true);
// Your own durable store or queue; skip the event if you have seen $event['id'] before.
if (!save_event($event)) {
    http_response_code(500); // Not stored, so we send it again.
    exit;
}
http_response_code(204);