Вебхуки

import crypto from 'crypto';

function verifyWebhook(rawBody, signature, webhookSecret) {
  const expected = crypto
    .createHmac('sha256', webhookSecret)
    .update(rawBody)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// В Express:
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-tranzor-signature'];

  if (!verifyWebhook(req.body, signature, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body);
  // Обработка события...

  res.status(200).send('OK');
});

import hmac
import hashlib

def verify_webhook(raw_body: bytes, signature: str, webhook_secret: str) -> bool:
    expected = hmac.new(
        webhook_secret.encode(),
        raw_body,
        hashlib.sha256,
    ).hexdigest()

    return hmac.compare_digest(signature, expected)

function verifyWebhook($rawBody, $signature, $webhookSecret) {
    $expected = hash_hmac('sha256', $rawBody, $webhookSecret);
    return hash_equals($expected, $signature);
}

// Использование:
$rawBody = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_TRANZOR_SIGNATURE'] ?? '';

if (!verifyWebhook($rawBody, $signature, $webhookSecret)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($rawBody, true);
// Обработка события...