Webhooks & signatures

import { createHmac, timingSafeEqual } from "node:crypto";

const TOLERANCE_SECONDS = 5 * 60;

// rawBody: the request body exactly as received (Buffer or string), before any
//          JSON parsing. With Express: express.raw({ type: "application/json" }).
// header:  the value of the X-Agentova-Signature header.
// secret:  the subscription's full secret, "whsec_" prefix included.
export function isValidAgentovaSignature(rawBody, header, secret, now = Date.now() / 1000) {
  if (typeof header !== "string") return false;
  const parts = {};
  for (const item of header.split(",")) {
    const [key, ...value] = item.trim().split("=");
    parts[key] = value.join("=");
  }
  const { t, v1 } = parts;
  if (!/^\d+$/.test(t ?? "") || !/^[0-9a-f]{64}$/.test(v1 ?? "")) return false;
  if (Math.abs(now - Number(t)) > TOLERANCE_SECONDS) return false;
  const expected = createHmac("sha256", secret).update(`${t}.`).update(rawBody).digest();
  return timingSafeEqual(expected, Buffer.from(v1, "hex"));
}

import hashlib
import hmac
import re
import time

TOLERANCE_SECONDS = 5 * 60


def is_valid_agentova_signature(raw_body, header, secret, now=None):
    """raw_body: the request body exactly as received (bytes), before any JSON
    parsing. With Flask: request.get_data(); with Django: request.body.
    header: the value of the X-Agentova-Signature header.
    secret: the subscription's full secret, "whsec_" prefix included."""
    if not header:
        return False
    parts = dict(item.strip().split("=", 1) for item in header.split(",") if "=" in item)
    t, v1 = parts.get("t", ""), parts.get("v1", "")
    if not re.fullmatch(r"[0-9]+", t) or not re.fullmatch(r"[0-9a-f]{64}", v1):
        return False
    if abs((time.time() if now is None else now) - int(t)) > TOLERANCE_SECONDS:
        return False
    expected = hmac.new(secret.encode(), t.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

<?php

const AGENTOVA_TOLERANCE_SECONDS = 300;

/**
 * $rawBody: the request body exactly as received: file_get_contents('php://input'),
 *           or $request->getContent() with Laravel.
 * $header:  the X-Agentova-Signature header: $_SERVER['HTTP_X_AGENTOVA_SIGNATURE'] ?? null.
 * $secret:  the subscription's full secret, "whsec_" prefix included.
 */
function is_valid_agentova_signature(string $rawBody, ?string $header, string $secret, ?int $now = null): bool
{
    if ($header === null) {
        return false;
    }
    $parts = [];
    foreach (explode(',', $header) as $item) {
        $pair = explode('=', trim($item), 2);
        if (count($pair) === 2) {
            $parts[$pair[0]] = $pair[1];
        }
    }
    $t = $parts['t'] ?? '';
    $v1 = $parts['v1'] ?? '';
    if (!ctype_digit($t) || strlen($v1) !== 64 || !ctype_xdigit($v1)) {
        return false;
    }
    if (abs(($now ?? time()) - (int) $t) > AGENTOVA_TOLERANCE_SECONDS) {
        return false;
    }
    return hash_equals(hash_hmac('sha256', $t . '.' . $rawBody, $secret), $v1);
}