Webhooks

import crypto from 'node:crypto';

/** rawBody: the request body exactly as received, before JSON parsing. */
export function isFromOnePay(secret, rawBody, header) {
  const parts = Object.fromEntries(
    header.split(',').map((part) => part.split('=', 2)),
  );
  const t = Number(parts.t);
  if (!Number.isInteger(t) || Math.abs(Date.now() / 1000 - t) > 300) {
    return false;
  }
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${t}.${rawBody}`)
    .digest();
  const given = Buffer.from(parts.v1 ?? '', 'hex');
  return given.length === expected.length && crypto.timingSafeEqual(given, expected);
}

import hashlib
import hmac
import time


def is_from_onepay(secret: str, raw_body: bytes, header: str) -> bool:
    """raw_body: the request body exactly as received."""
    parts = dict(part.split("=", 1) for part in header.split(",") if "=" in part)
    try:
        t = int(parts.get("t", ""))
    except ValueError:
        return False
    if abs(time.time() - t) > 300:
        return False
    expected = hmac.new(
        secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", ""))

<?php
// $rawBody = file_get_contents('php://input');
function is_from_onepay(string $secret, string $rawBody, string $header): bool
{
    $parts = [];
    foreach (explode(',', $header) as $part) {
        [$key, $value] = array_pad(explode('=', $part, 2), 2, '');
        $parts[trim($key)] = trim($value);
    }
    $t = filter_var($parts['t'] ?? '', FILTER_VALIDATE_INT);
    if ($t === false || abs(time() - $t) > 300) {
        return false;
    }
    $expected = hash_hmac('sha256', $t . '.' . $rawBody, $secret);
    return hash_equals($expected, $parts['v1'] ?? '');
}