Webhooks

import crypto from 'crypto'

function verifyActeroSignature(req, secret) {
  const sig = req.headers['x-actero-signature']?.replace(/^v1=/, '')
  const ts = req.headers['x-actero-timestamp']
  if (!sig || !ts) return false

  // Anti-rejeu : refuser les requêtes vieilles de plus de 5 minutes.
  const age = Math.abs(Date.now() / 1000 - Number(ts))
  if (age > 300) return false

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${ts}.${req.rawBody}`)
    .digest('hex')

  return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))
}

import hmac, hashlib, time

def verify_actero_signature(headers, raw_body, secret):
    sig = headers.get("x-actero-signature", "").removeprefix("v1=")
    ts = headers.get("x-actero-timestamp", "")
    if not sig or not ts:
        return False
    if abs(time.time() - int(ts)) > 300:
        return False  # anti-rejeu

    expected = hmac.new(
        secret.encode(),
        f"{ts}.{raw_body.decode()}".encode(),
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(sig, expected)

# Reproduire une signature en local pour debug
echo -n "1745318400.$(cat body.json)" \
  | openssl dgst -sha256 -hmac "$WHSEC" \
  | awk '{print "v1="$2}'