Webhooks

use Illuminate\Http\Request;

Route::post('/webhooks/lekalao', function (Request $request) {
    $header = (string) $request->header('Lekalao-Signature');
    $parts = [];

    foreach (explode(',', $header) as $part) {
        [$key, $value] = array_pad(explode('=', trim($part), 2), 2, '');
        $parts[$key][] = $value;
    }

    $timestamp = (int) ($parts['t'][0] ?? 0);
    abort_if(abs(time() - $timestamp) > 300, 401);

    $expected = hash_hmac('sha256', $timestamp.'.'.$request->getContent(), config('services.lekalao.webhook_secret'));
    $valid = collect($parts['v1'] ?? [])->contains(fn (string $given) => hash_equals($expected, $given));
    abort_unless($valid, 401);

    // Seen already: a retry of an event you handled. Answer 2xx, do nothing.
    if (! Cache::add('lekalao-event:'.$request->header('Lekalao-Event-Id'), true, now()->addDays(3))) {
        return response()->noContent();
    }

    match ($request->input('event')) {
        'subscriber.unsubscribed' => Customer::where('email', $request->input('data.email'))
            ->update(['newsletter' => false]),
        'transactional.bounced' => Order::where('mail_id', $request->input('data.id'))
            ->update(['receipt_bounced' => true]),
        default => null,
    };

    return response()->noContent();
});

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const TOLERANCE = 300; // seconds

function verify(rawBody, header, secret) {
    const parts = header.split(',').map((part) => {
        const at = part.indexOf('=');
        return [part.slice(0, at).trim(), part.slice(at + 1).trim()];
    });
    const timestamp = Number(parts.find(([key]) => key === 't')?.[1]);

    if (!Number.isInteger(timestamp) || Math.abs(Date.now() / 1000 - timestamp) > TOLERANCE) {
        return false;
    }

    const expected = crypto
        .createHmac('sha256', secret)
        .update(`${timestamp}.`)
        .update(rawBody)
        .digest('hex');

    return parts
        .filter(([key]) => key === 'v1')
        .some(([, given]) => given.length === expected.length
            && crypto.timingSafeEqual(Buffer.from(given), Buffer.from(expected)));
}

app.post(
    '/webhooks/lekalao',
    express.raw({ type: 'application/json' }),
    (req, res) => {
        if (!verify(req.body, req.get('Lekalao-Signature') ?? '', process.env.LEKALAO_WEBHOOK_SECRET)) {
            return res.sendStatus(401);
        }

        const { id, event, data } = JSON.parse(req.body);
        // Deduplicate on id (also Lekalao-Event-Id), then queue the work.
        res.sendStatus(204);
    },
);

import hashlib
import hmac
import os
import time

from flask import Flask, abort, request

app = Flask(__name__)
TOLERANCE = 300  # seconds


def verify(raw_body: bytes, header: str, secret: str) -> bool:
    parts = [part.strip().split("=", 1) for part in header.split(",") if "=" in part]
    timestamps = [value for key, value in parts if key == "t"]
    if not timestamps or not timestamps[0].isdigit():
        return False
    timestamp = int(timestamps[0])
    if abs(time.time() - timestamp) > TOLERANCE:
        return False
    expected = hmac.new(secret.encode(), f"{timestamp}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(expected, value) for key, value in parts if key == "v1")


@app.post("/webhooks/lekalao")
def lekalao():
    if not verify(request.get_data(), request.headers.get("Lekalao-Signature", ""), os.environ["LEKALAO_WEBHOOK_SECRET"]):
        abort(401)

    payload = request.get_json()
    # Deduplicate on payload["id"] (also Lekalao-Event-Id), then queue the work.
    return "", 204