Webhook

import { createHmac, timingSafeEqual } from "node:crypto";
import express from "express";

const SECRET = process.env.GESTIONESALA_WEBHOOK_SECRET;
const app = express();

app.post("/hook", express.raw({ type: "application/json" }), (req, res) => {
  const timestamp = req.get("X-Gestionesala-Timestamp") ?? "";
  const key = req.get("X-Gestionesala-Idempotency-Key") ?? "";
  const header = req.get("X-Gestionesala-Signature") ?? "";

  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return res.sendStatus(400);

  const signed = `v1\n${timestamp}\n${key}\n${req.body.toString("utf8")}`;
  const expected = Buffer.from("v1=" + createHmac("sha256", SECRET).update(signed).digest("hex"));
  const valid = header.split(",").some((signature) => {
    const received = Buffer.from(signature.trim());
    return received.length === expected.length && timingSafeEqual(received, expected);
  });
  if (!valid) return res.sendStatus(401);

  const event = JSON.parse(req.body.toString("utf8"));
  // Elabora event.type ed event.data, deduplicando su key.
  res.sendStatus(200);
});

import hashlib
import hmac
import os
import time

from flask import Flask, abort, request

SECRET = os.environ["GESTIONESALA_WEBHOOK_SECRET"].encode()
app = Flask(__name__)


@app.post("/hook")
def hook():
    timestamp = request.headers.get("X-Gestionesala-Timestamp", "")
    key = request.headers.get("X-Gestionesala-Idempotency-Key", "")
    header = request.headers.get("X-Gestionesala-Signature", "")
    body = request.get_data()

    if not timestamp.isdigit() or abs(time.time() - int(timestamp)) > 300:
        abort(400)

    signed = b"v1\n" + timestamp.encode() + b"\n" + key.encode() + b"\n" + body
    expected = "v1=" + hmac.new(SECRET, signed, hashlib.sha256).hexdigest()
    if not any(hmac.compare_digest(expected, s.strip()) for s in header.split(",")):
        abort(401)

    event = request.get_json()
    # Elabora event["type"] ed event["data"], deduplicando su key.
    return "", 200