Outbound webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

const TOLERANCE_SECONDS = 300;

export function verifyRingeeWebhook(
  rawBody: string,
  signatureHeader: string | null,
  timestampHeader: string | null,
  secret: string,
): boolean {
  if (!signatureHeader || !timestampHeader) return false;

  const parts = Object.fromEntries(
    signatureHeader.split(",").map((p) => p.split("=") as [string, string]),
  );
  const timestamp = parts.t;
  const signature = parts.v1;
  if (!timestamp || !signature) return false;
  if (timestamp !== timestampHeader) return false;
  if (!/^[0-9a-f]{64}$/i.test(signature)) return false;

  const age = Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp));
  if (!Number.isFinite(age) || age > TOLERANCE_SECONDS) return false;

  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  if (expected.length !== signature.length) return false;
  return timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(signature, "hex"),
  );
}

import hashlib, hmac, time

TOLERANCE_SECONDS = 300

def verify_ringee_webhook(raw_body: str, signature_header: str,
                          timestamp_header: str, secret: str) -> bool:
    if not signature_header or not timestamp_header:
        return False

    try:
        parts = dict(p.split("=", 1) for p in signature_header.split(","))
    except ValueError:
        return False

    timestamp, signature = parts.get("t"), parts.get("v1")
    if not timestamp or not signature or timestamp != timestamp_header:
        return False

    if len(signature) != 64 or any(c not in "0123456789abcdefABCDEF" for c in signature):
        return False

    try:
        age = abs(int(time.time()) - int(timestamp))
    except ValueError:
        return False
    if age > TOLERANCE_SECONDS:
        return False

    expected = hmac.new(
        secret.encode(), f"{timestamp}.{raw_body}".encode(), hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

Deno.serve(async (req) => {
  const rawBody = await req.text(); // raw first — never req.json()

  const ok = verifyRingeeWebhook(
    rawBody,
    req.headers.get("Ringee-Signature"),
    req.headers.get("Ringee-Timestamp"),
    Deno.env.get("RINGEE_WEBHOOK_SIGNING_SECRET")!,
  );

  if (!ok) return new Response("invalid signature", { status: 401 });

  const event = JSON.parse(rawBody);
  await handleEvent(event);

  return new Response(JSON.stringify({ received: true }), { status: 200 });
});