Verify signatures

const crypto = require("node:crypto");

function verifyWizzgiftSignature(header, rawBody, secret, toleranceMs = 300_000) {
  const parts = header.split(",").map((p) => p.split("="));
  const t = Number(parts.find(([k]) => k === "t")?.[1]);
  const sigs = parts.filter(([k]) => k === "v1").map(([, v]) => v);
  if (!t || Math.abs(Date.now() - t) > toleranceMs) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");

  return sigs.some((sig) => {
    try {
      return crypto.timingSafeEqual(Buffer.from(sig, "hex"), Buffer.from(expected, "hex"));
    } catch {
      return false;
    }
  });
}

// Express example — note express.raw, NOT express.json
app.post("/wizzgift/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const ok = verifyWizzgiftSignature(
    req.header("X-Wizzgift-Signature"),
    req.body.toString("utf8"),
    process.env.WIZZGIFT_WEBHOOK_SECRET,
  );
  if (!ok) return res.status(400).send("invalid signature");

  res.sendStatus(200); // acknowledge fast, process async
  const event = JSON.parse(req.body);
  queue.push(event);
});

import hashlib
import hmac
import time


def verify_wizzgift_signature(header: str, raw_body: bytes, secret: str,
                              tolerance_ms: int = 300_000) -> bool:
    parts = [p.split("=", 1) for p in header.split(",")]
    t = next((v for k, v in parts if k == "t"), None)
    sigs = [v for k, v in parts if k == "v1"]
    if t is None or abs(time.time() * 1000 - int(t)) > tolerance_ms:
        return False

    expected = hmac.new(
        secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256
    ).hexdigest()

    return any(hmac.compare_digest(sig, expected) for sig in sigs)


# Flask example — use request.get_data(), not request.json
@app.post("/wizzgift/webhook")
def wizzgift_webhook():
    if not verify_wizzgift_signature(
        request.headers.get("X-Wizzgift-Signature", ""),
        request.get_data(),
        WIZZGIFT_WEBHOOK_SECRET,
    ):
        return "invalid signature", 400
    process_async(request.get_json())
    return "", 200

function verifyWizzgiftSignature(
    string $header,
    string $rawBody,
    string $secret,
    int $toleranceMs = 300000
): bool {
    $t = null;
    $sigs = [];
    foreach (explode(',', $header) as $part) {
        [$k, $v] = explode('=', $part, 2);
        if ($k === 't') $t = (int) $v;
        if ($k === 'v1') $sigs[] = $v;
    }
    if ($t === null || abs((int) (microtime(true) * 1000) - $t) > $toleranceMs) {
        return false;
    }

    $expected = hash_hmac('sha256', $t . '.' . $rawBody, $secret);
    foreach ($sigs as $sig) {
        if (hash_equals($expected, $sig)) return true;
    }
    return false;
}

// Usage
$rawBody = file_get_contents('php://input');
$ok = verifyWizzgiftSignature(
    $_SERVER['HTTP_X_WIZZGIFT_SIGNATURE'] ?? '',
    $rawBody,
    getenv('WIZZGIFT_WEBHOOK_SECRET')
);
if (!$ok) {
    http_response_code(400);
    exit;
}