Webhooks

import hashlib
import hmac

def verify_webhook_signature(secret_hex: str, signature_header: str, raw_body: bytes) -> bool:
    try:
        parts = signature_header.split(',')
        timestamp = int(parts[1].split('=')[1])
        provided_signature = parts[2].split('=')[1]
        
        signed_payload = f"{timestamp}.{raw_body.decode()}"
        key = bytes.fromhex(secret_hex)
        expected_signature = hmac.new(key, signed_payload.encode(), hashlib.sha256).hexdigest()
        
        return hmac.compare_digest(provided_signature, expected_signature)
    except:
        return False

const crypto = require('crypto');

function verifyWebhookSignature(secretHex, signatureHeader, rawBody) {
    try {
        const parts = signatureHeader.split(',');
        const timestamp = parseInt(parts[1].split('=')[1]);
        const providedSignature = parts[2].split('=')[1];
        
        const signedPayload = `${timestamp}.${rawBody}`;
        const key = Buffer.from(secretHex, 'hex');
        const expectedSignature = crypto
            .createHmac('sha256', key)
            .update(signedPayload)
            .digest('hex');
        
        return crypto.timingSafeEqual(
            Buffer.from(providedSignature, 'hex'),
            Buffer.from(expectedSignature, 'hex')
        );
    } catch {
        return false;
    }
}