Webhooks

import { verifyWebhookSignature } from "@dukkan.one/app-sdk/webhooks";

const verdict = await verifyWebhookSignature({
  rawBody,                                  // the request bytes, never re-serialised
  timestamp: headers.get("x-dukkan-timestamp"),
  signature: headers.get("x-dukkan-hmac-sha256"),
  secret,                                   // or [current, previous] during a rotation
});
if (!verdict.ok) return new Response(JSON.stringify({ error: verdict.reason }), { status: 401 });

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyDukkanWebhook(secret, headers, rawBody) {
  const timestamp = headers["x-dukkan-timestamp"];
  const signature = headers["x-dukkan-hmac-sha256"];
  if (!timestamp || !signature) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  const expected = createHmac("sha256", secret)
    .update(timestamp).update(".").update(rawBody).digest();
  const received = Buffer.from(signature, "hex");
  return expected.length === received.length && timingSafeEqual(expected, received);
}

// Cloudflare Workers, Deno, Bun: request.arrayBuffer() gives the raw bytes.
export async function verifyDukkanWebhook(secret, request, rawBody) {
  const timestamp = request.headers.get("x-dukkan-timestamp") ?? "";
  const signature = request.headers.get("x-dukkan-hmac-sha256") ?? "";
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  const key = await crypto.subtle.importKey(
    "raw", new TextEncoder().encode(secret),
    { name: "HMAC", hash: "SHA-256" }, false, ["sign"],
  );
  const prefix = new TextEncoder().encode(timestamp + ".");
  const message = new Uint8Array(prefix.length + rawBody.byteLength);
  message.set(prefix, 0);
  message.set(new Uint8Array(rawBody), prefix.length);
  const mac = new Uint8Array(await crypto.subtle.sign("HMAC", key, message));
  const received = Uint8Array.from(signature.match(/../g) ?? [], (h) => parseInt(h, 16));
  if (received.length !== mac.length) return false;
  let diff = 0;
  for (let i = 0; i < mac.length; i++) diff |= mac[i] ^ received[i];
  return diff === 0;
}

import hashlib
import hmac
import time


def verify_dukkan_webhook(secret: str, headers: dict, raw_body: bytes) -> bool:
    timestamp = headers.get("x-dukkan-timestamp", "")
    signature = headers.get("x-dukkan-hmac-sha256", "")
    if not timestamp or not signature:
        return False
    if abs(time.time() - int(timestamp)) > 300:
        return False
    expected = hmac.new(
        secret.encode(), timestamp.encode() + b"." + raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

<?php
function verifyDukkanWebhook(string $secret, array $headers, string $rawBody): bool
{
    $timestamp = $headers['x-dukkan-timestamp'] ?? '';
    $signature = $headers['x-dukkan-hmac-sha256'] ?? '';
    if ($timestamp === '' || $signature === '') {
        return false;
    }
    if (abs(time() - (int) $timestamp) > 300) {
        return false;
    }
    $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    return hash_equals($expected, $signature);
}