Verificação de assinatura

# Smoke-test contra um payload e segredo conhecidos.
# Útil para debug: produza a assinatura você mesmo e compare com o header.
TIMESTAMP=1714500000
BODY='{"id":"evt_01J","type":"conversion.completed","data":{}}'
SECRET='whsec_yoursecret'

# Reconstrói o payload assinado
SIGNED="${TIMESTAMP}.${BODY}"

# HMAC-SHA256, hexadecimal
echo -n "$SIGNED" | openssl dgst -sha256 -hmac "$SECRET" -hex | awk '{print $2}'
# → bate com o valor v1= de X-Blendfi-Signature

import crypto from "node:crypto";
import express from "express";

const app = express();

// Crítico: capture o body bruto, não um parseado nem re-serializado.
app.post(
  "/blendfi-webhooks",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const rawBody = req.body.toString("utf8");
    const id = req.header("x-blendfi-event-id");
    const signatureHeader = req.header("x-blendfi-signature");

    if (!id || !signatureHeader) {
      return res.status(401).send("missing webhook headers");
    }

    // Separa "t=<unix>,v1=<hex>" nos seus componentes.
    const parts = Object.fromEntries(
      signatureHeader.split(",").map((p) => p.split("=", 2)),
    );
    const timestamp = parts.t;
    const provided = parts.v1;
    if (!timestamp || !provided) {
      return res.status(401).send("malformed signature header");
    }

    // Janela de replay
    const skew = Math.abs(Date.now() / 1000 - Number(timestamp));
    if (skew > 300) {
      return res.status(401).send("timestamp outside 300s window");
    }

    const signedPayload = `${timestamp}.${rawBody}`;
    const expected = crypto
      .createHmac("sha256", process.env.BLENDFI_WEBHOOK_SECRET)
      .update(signedPayload)
      .digest("hex");

    const a = Buffer.from(provided);
    const b = Buffer.from(expected);
    const match =
      a.length === b.length && crypto.timingSafeEqual(a, b);

    if (!match) {
      return res.status(401).send("signature mismatch");
    }

    // Dedup em id (Redis com TTL ≥ janela de retentativa), pseudo:
    // if (await redis.exists(`webhook:${id}`)) return res.sendStatus(200);
    // await redis.set(`webhook:${id}`, "1", "EX", 600);

    // Ack rápido; faça o trabalho real de forma assíncrona.
    res.sendStatus(200);
    queue.enqueue({ id, body: JSON.parse(rawBody) });
  },
);

import hmac, hashlib, time, os
from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ["BLENDFI_WEBHOOK_SECRET"].encode()

@app.post("/blendfi-webhooks")
def handle():
    raw = request.get_data()  # bytes brutos; NÃO use request.json
    id_ = request.headers.get("X-Blendfi-Event-Id")
    sig_hdr = request.headers.get("X-Blendfi-Signature", "")

    if not id_ or not sig_hdr:
        return "missing webhook headers", 401

    # Separa "t=<unix>,v1=<hex>" nos seus componentes.
    parts = dict(p.split("=", 1) for p in sig_hdr.split(",") if "=" in p)
    ts = parts.get("t")
    provided = parts.get("v1")
    if not ts or not provided:
        return "malformed signature header", 401

    # Janela de replay
    if abs(time.time() - int(ts)) > 300:
        return "timestamp outside 300s window", 401

    signed_payload = f"{ts}.".encode() + raw
    expected = hmac.new(SECRET, signed_payload, hashlib.sha256).hexdigest()

    if not hmac.compare_digest(provided, expected):
        return "signature mismatch", 401

    # Dedup em id (pseudo Redis):
    # if redis.exists(f"webhook:{id_}"): return "", 200
    # redis.setex(f"webhook:{id_}", 600, "1")

    # Ack rápido; enfileire o trabalho real.
    queue.put({"id": id_, "body": request.json})
    return "", 200