Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyNeuralDraftSignature(
  body: string,
  header: string,
  secret: string,
  toleranceSeconds = 300
): boolean {
  const parts = Object.fromEntries(
    header.split(",").map((p) => p.split("=") as [string, string])
  );
  const t = Number(parts.t);
  const v1 = parts.v1;
  if (!Number.isFinite(t) || !v1) return false;

  // Reject ancient deliveries — protects against replay.
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - t) > toleranceSeconds) return false;

  const signed = `${t}.${body}`;
  const expected = createHmac("sha256", secret).update(signed).digest("hex");

  // Constant-time compare; both sides must be the same length.
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(v1, "hex");
  if (a.length !== b.length) return false;
  return timingSafeEqual(a, b);
}

import hmac, hashlib, time

def verify_neural_draft_signature(
    body: bytes, header: str, secret: str, tolerance_seconds: int = 300
) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    try:
        t = int(parts["t"])
        v1 = parts["v1"]
    except (KeyError, ValueError):
        return False

    if abs(int(time.time()) - t) > tolerance_seconds:
        return False

    signed = f"{t}.{body.decode('utf-8')}".encode()
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

<?php
function verifyNeuralDraftSignature(
    string $body,
    string $header,
    string $secret,
    int $toleranceSeconds = 300
): bool {
    $parts = [];
    foreach (explode(',', $header) as $kv) {
        [$k, $v] = array_pad(explode('=', $kv, 2), 2, null);
        $parts[$k] = $v;
    }

    $t = isset($parts['t']) ? (int) $parts['t'] : 0;
    $v1 = $parts['v1'] ?? '';
    if (!$t || !$v1) {
        return false;
    }

    if (abs(time() - $t) > $toleranceSeconds) {
        return false;
    }

    $signed = $t . '.' . $body;
    $expected = hash_hmac('sha256', $signed, $secret);

    return hash_equals($expected, $v1);
}