Payment Webhooks

import hashlib
import hmac
import time

def verify_flouci_get_webhook(payment_id: str, success: str, signature_header: str, private_token: str, tolerance_seconds: int = 300) -> bool:
    parts = dict(item.split("=", 1) for item in signature_header.split(","))
    timestamp, received = parts["t"], parts["v1"]
    if abs(time.time() - int(timestamp)) > tolerance_seconds:
        return False
    signed = f"{timestamp}.payment_id={payment_id}&success={success}"
    expected = hmac.new(private_token.encode(), signed.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, received)

# Flask example
# ok = verify_flouci_get_webhook(request.args["payment_id"], request.args["success"],
#                                request.headers["X-Flouci-Signature"], PRIVATE_TOKEN)

const crypto = require("crypto");

function verifyFlouciGetWebhook(paymentId, success, signatureHeader, privateToken, toleranceSeconds = 300) {
  const parts = Object.fromEntries(signatureHeader.split(",").map((p) => p.split("=")));
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > toleranceSeconds) return false;
  const expected = crypto
    .createHmac("sha256", privateToken)
    .update(`${parts.t}.payment_id=${paymentId}&success=${success}`)
    .digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(parts.v1, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Express example
// const ok = verifyFlouciGetWebhook(req.query.payment_id, req.query.success, req.get("X-Flouci-Signature"), PRIVATE_TOKEN);