Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(req: { headers: Record<string,string>, rawBody: Buffer }, secret: string) {
  const sig = req.headers["x-ovra-signature"] ?? "";
  const ts  = req.headers["x-ovra-timestamp"] ?? "";
  const id  = req.headers["x-ovra-delivery-id"] ?? "";
  const expected = "sha256=" + createHmac("sha256", secret)
    .update(`${id}.${ts}.${req.rawBody.toString("utf8")}`)
    .digest("hex");
  return timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
}

import hmac, hashlib
def verify(headers, raw_body, secret):
    sig = headers.get("x-ovra-signature", "")
    ts  = headers.get("x-ovra-timestamp", "")
    did = headers.get("x-ovra-delivery-id", "")
    expected = "sha256=" + hmac.new(secret.encode(),
        f"{did}.{ts}.{raw_body.decode()}".encode(),
        hashlib.sha256).hexdigest()
    return hmac.compare_digest(sig, expected)