Webhooks

// commercy-verify-node
const crypto = require("crypto");

const TOLERANCE_SECONDS = 300; // 5 minutos

// headers: nombres en minúscula (como los entrega Node/Express).
function verifyCommercyWebhook(rawBody, headers, secret, nowSec = Math.floor(Date.now() / 1000)) {
  const timestamp = headers["x-commercy-timestamp"];
  const signature = headers["x-commercy-signature"];
  if (!timestamp || !signature) return false;

  const ts = Number(timestamp);
  if (!Number.isInteger(ts) || Math.abs(nowSec - ts) > TOLERANCE_SECONDS) return false;

  const expected = "v1=" + crypto.createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(String(signature));
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

module.exports = { verifyCommercyWebhook };

<?php
function verify_commercy_webhook(string $raw, array $headers, string $secret, ?int $now = null): bool {
    $now = $now ?? time();
    $headers = array_change_key_case($headers, CASE_LOWER); // HTTP/2 manda los nombres en minúscula
    $ts = $headers['x-commercy-timestamp'] ?? '';
    $sig = $headers['x-commercy-signature'] ?? '';
    if ($ts === '' || $sig === '' || !ctype_digit($ts)) return false;
    if (abs($now - (int)$ts) > 300) return false;

    $expected = 'v1=' . hash_hmac('sha256', $ts . '.' . $raw, $secret);
    return hash_equals($expected, $sig);
}

$raw = file_get_contents('php://input'); // cuerpo crudo
$ok = verify_commercy_webhook($raw, getallheaders(), getenv('COMMERCY_WEBHOOK_SECRET'));
http_response_code($ok ? 200 : 401);

import hashlib
import hmac
import time
from typing import Optional

def verify_commercy_webhook(raw: bytes, headers, secret: str, now: Optional[int] = None) -> bool:
    ts = headers.get("X-Commercy-Timestamp", "")
    sig = headers.get("X-Commercy-Signature", "")
    if not ts.isdigit() or not sig:
        return False
    if abs((now if now is not None else int(time.time())) - int(ts)) > 300:
        return False
    expected = "v1=" + hmac.new(secret.encode(), f"{ts}.".encode() + raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, sig)

# Flask: raw = request.get_data()  (cuerpo crudo, antes de request.json)