Webhooks

import base64
import hashlib
import hmac


def verify(secret: str, webhook_id: str, timestamp: int, body: bytes, header: str) -> bool:
    # Accept both base64 alphabets + missing padding (real secrets are urlsafe/unpadded).
    token = secret.removeprefix("whsec_").replace("+", "-").replace("/", "_")
    key = base64.urlsafe_b64decode(token + "=" * (-len(token) % 4))
    signed_input = f"{webhook_id}.{timestamp}.".encode() + body
    expected = base64.b64encode(
        hmac.new(key, signed_input, hashlib.sha256).digest(),
    ).decode("ascii")
    valid = False
    for candidate in header.split(" "):
        if candidate.startswith("v1,"):
            valid = hmac.compare_digest(candidate[3:], expected) or valid
    return valid


# Fixed test vector — any correct implementation reproduces this signature.
assert verify(
    "whsec_c2FtcGxlLXNlY3JldC1kby1ub3QtdXNl",
    "msg_2n0jJ2mCw4T5qX1aB3cD4e",
    1782043200,
    b'{"type":"image.generation.completed","created_at":"2026-07-02T12:00:00Z",'
    b'"data":{"id":"7f9c0e2a-1b3d-4c5e-8f6a-9b0c1d2e3f40","object":"image.generation",'
    b'"status":"completed"}}',
    "v1,F9epTMwALBtPM7ghiLNEmdmVN7TizCpZ+zAHLPwip9A=",
)

import crypto from "node:crypto";

function verify(
  secret: string,
  webhookId: string,
  timestamp: number,
  body: Buffer,
  header: string,
): boolean {
  // Accept both base64 alphabets + missing padding (real secrets are urlsafe/unpadded).
  const token = secret.replace(/^whsec_/, "").replace(/-/g, "+").replace(/_/g, "/");
  const key = Buffer.from(token, "base64");
  const signedInput = Buffer.concat([
    Buffer.from(`${webhookId}.${timestamp}.`, "utf8"),
    body,
  ]);
  const expected = crypto.createHmac("sha256", key).update(signedInput).digest("base64");
  let valid = false;
  for (const candidate of header.split(" ")) {
    if (!candidate.startsWith("v1,")) continue;
    const sig = Buffer.from(candidate.slice(3));
    const exp = Buffer.from(expected);
    if (sig.length === exp.length && crypto.timingSafeEqual(sig, exp)) valid = true;
  }
  return valid;
}

// Fixed test vector — any correct implementation reproduces this signature.
const ok = verify(
  "whsec_c2FtcGxlLXNlY3JldC1kby1ub3QtdXNl",
  "msg_2n0jJ2mCw4T5qX1aB3cD4e",
  1782043200,
  Buffer.from(
    '{"type":"image.generation.completed","created_at":"2026-07-02T12:00:00Z",' +
      '"data":{"id":"7f9c0e2a-1b3d-4c5e-8f6a-9b0c1d2e3f40","object":"image.generation",' +
      '"status":"completed"}}',
    "utf8",
  ),
  "v1,F9epTMwALBtPM7ghiLNEmdmVN7TizCpZ+zAHLPwip9A=",
);
if (!ok) throw new Error("signature verification failed");