Webhooks Troko

import crypto from "node:crypto";

function verifyWebhook(rawBody, timestamp, signature, secret) {
  // Rejeitar timestamps com mais de 5 minutos
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - Number(timestamp)) > 300) {
    return false;
  }

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(signature, "hex"),
  );
}

// Uso com Express:
app.post("/troko-hook", (req, res) => {
  const sig = req.headers["troko-signature"];
  const ts = req.headers["troko-timestamp"];

  if (!verifyWebhook(req.rawBody, ts, sig, process.env.WEBHOOK_SECRET)) {
    return res.status(401).json({ error: "Invalid signature" });
  }

  const event = req.body;
  console.log("Evento recebido:", event.type);

  res.status(200).json({ received: true });
});

import hmac
import hashlib
import time

def verify_webhook(raw_body: bytes, timestamp: str, signature: str, secret: str) -> bool:
    # Rejeitar timestamps com mais de 5 minutos
    now = int(time.time())
    if abs(now - int(timestamp)) > 300:
        return False

    expected = hmac.new(
        secret.encode("utf-8"),
        f"{timestamp}.{raw_body.decode('utf-8')}".encode("utf-8"),
        hashlib.sha256,
    ).hexdigest()

    return hmac.compare_digest(expected, signature)

# Uso com Flask:
@app.route("/troko-hook", methods=["POST"])
def webhook():
    sig = request.headers.get("Troko-Signature")
    ts = request.headers.get("Troko-Timestamp")

    if not verify_webhook(request.data, ts, sig, os.environ["WEBHOOK_SECRET"]):
        return {"error": "Invalid signature"}, 401

    event = request.json
    print(f"Evento recebido: {event['type']}")

    return {"received": True}, 200