React to catalogue changes.

import crypto from "node:crypto";

const MAX_AGE_SECONDS = 300;

function verifyVieuniteWebhook({ rawBody, headers, secret }) {
  if (!Buffer.isBuffer(rawBody)) {
    throw new TypeError("rawBody must be the unparsed request Buffer");
  }

  const timestamp = headers["x-vieunite-timestamp"] || "";
  const supplied = headers["x-vieunite-signature"] || "";
  if (!/^\d+$/.test(timestamp)) return false;

  const timestampSeconds = Number(timestamp);
  const age = Math.abs(Math.floor(Date.now() / 1000) - timestampSeconds);
  if (!Number.isSafeInteger(timestampSeconds) || age > MAX_AGE_SECONDS) {
    return false;
  }

  const signedBytes = Buffer.concat([
    Buffer.from(timestamp, "ascii"),
    Buffer.from(".", "ascii"),
    rawBody,
  ]);
  const digest = crypto
    .createHmac("sha256", secret)
    .update(signedBytes)
    .digest("base64");
  const expected = Buffer.from(`v1=${digest}`, "ascii");
  const received = Buffer.from(supplied, "ascii");

  return expected.length === received.length &&
    crypto.timingSafeEqual(expected, received);
}

import base64
import hashlib
import hmac
import time

MAX_AGE_SECONDS = 300


def verify_vieunite_webhook(*, raw_body: bytes, headers, secret: str) -> bool:
    if not isinstance(raw_body, bytes):
        raise TypeError("raw_body must be the unparsed request bytes")

    timestamp = headers.get("x-vieunite-timestamp", "")
    supplied = headers.get("x-vieunite-signature", "")
    if not timestamp.isascii() or not timestamp.isdigit():
        return False

    age = abs(int(time.time()) - int(timestamp))
    if age > MAX_AGE_SECONDS:
        return False

    signed_bytes = timestamp.encode("ascii") + b"." + raw_body
    digest = base64.b64encode(
        hmac.new(secret.encode("utf-8"), signed_bytes, hashlib.sha256).digest()
    ).decode("ascii")

    return hmac.compare_digest(f"v1={digest}", supplied)

<?php

const MAX_AGE_SECONDS = 300;

function verifyVieuniteWebhook(
    string $rawBody,
    array $headers,
    string $secret
): bool {
    $timestamp = $headers["x-vieunite-timestamp"] ?? "";
    $supplied = $headers["x-vieunite-signature"] ?? "";
    if (!ctype_digit($timestamp)) {
        return false;
    }

    $timestampSeconds = filter_var($timestamp, FILTER_VALIDATE_INT);
    if ($timestampSeconds === false ||
        abs(time() - $timestampSeconds) > MAX_AGE_SECONDS) {
        return false;
    }

    // $rawBody must come directly from php://input. PHP strings are binary-safe.
    $signedBytes = $timestamp . "." . $rawBody;
    $digest = base64_encode(
        hash_hmac("sha256", $signedBytes, $secret, true)
    );

    return hash_equals("v1=" . $digest, $supplied);
}