Webhooks

import crypto from "node:crypto";

// mount with: express.raw({ type: "application/json" })
app.post("/alentra-webhook", (req, res) => {
  const ts = req.get("X-Alentra-Timestamp");
  const sig = req.get("X-Alentra-Signature");
  const expected = crypto
    .createHmac("sha256", process.env.ALENTRA_WEBHOOK_SECRET)
    .update(`${ts}.`)
    .update(req.body) // req.body is the raw Buffer
    .digest();
  const provided = Buffer.from(sig ?? "", "hex");

  const ok =
    provided.length === expected.length &&
    crypto.timingSafeEqual(provided, expected);
  if (!ok) return res.sendStatus(401);

  // Optional: reject stale timestamps to limit replay windows.
  const event = JSON.parse(req.body.toString());
  // ...handle event, dedupe on X-Alentra-Delivery-Id...
  res.sendStatus(200);
});

import hmac, hashlib
from flask import request, abort

@app.post("/alentra-webhook")
def alentra_webhook():
    ts = request.headers.get("X-Alentra-Timestamp", "")
    sig = request.headers.get("X-Alentra-Signature", "")
    raw = request.get_data()  # raw bytes
    mac = hmac.new(
        SECRET.encode(), f"{ts}.".encode() + raw, hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(mac, sig):
        abort(401)
    # ...handle, dedupe on X-Alentra-Delivery-Id...
    return "", 200