Webhooks

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const SECRET = process.env.DOLFIN_WEBHOOK_SECRET; // whsec_...
const TOLERANCE_SECONDS = 300;

// The raw body is required — a re-serialized object will not match the signature.
app.post(
  '/webhooks/dolfin',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const header = req.get('Dolfin-Signature') ?? '';
    const parts = Object.fromEntries(
      header.split(',').map(p => p.split('=').map(s => s.trim())),
    );
    const { t, v1 } = parts;

    if (!t || !v1) return res.sendStatus(400);

    if (Math.abs(Date.now() / 1000 - Number(t)) > TOLERANCE_SECONDS) {
      return res.sendStatus(400);
    }

    const expected = crypto
      .createHmac('sha256', SECRET)
      .update(`${t}.${req.body.toString('utf8')}`)
      .digest('hex');

    const ok =
      expected.length === v1.length &&
      crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));

    if (!ok) return res.sendStatus(401);

    const event = JSON.parse(req.body.toString('utf8'));
    handleEvent(event); // your logic
    res.sendStatus(200);
  },
);

import hashlib
import hmac
import os
import time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["DOLFIN_WEBHOOK_SECRET"]  # whsec_...
TOLERANCE_SECONDS = 300


@app.post("/webhooks/dolfin")
def dolfin_webhook():
    header = request.headers.get("Dolfin-Signature", "")
    parts = dict(
        p.strip().split("=", 1) for p in header.split(",") if "=" in p
    )
    timestamp, signature = parts.get("t"), parts.get("v1")

    if not timestamp or not signature:
        abort(400)

    if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        abort(400)

    # Use the raw body — re-serializing the parsed JSON will not match.
    raw = request.get_data()
    expected = hmac.new(
        SECRET.encode("utf-8"),
        f"{timestamp}.".encode("utf-8") + raw,
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected, signature):
        abort(401)

    handle_event(request.get_json())  # your logic
    return "", 200