Subscribe to canonical TeamStores.AI events

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(req, secret) {
  const sig = req.headers["x-ryte-signature"] || "";
  const t = /t=(\d+)/.exec(sig)?.[1];
  const v1 = /v1=([a-f0-9]+)/.exec(sig)?.[1];
  if (!t || !v1) throw new Error("missing signature");

  // Reject anything older than 5 minutes (replay protection).
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) {
    throw new Error("signature too old");
  }

  const expected = createHmac("sha256", secret)
    .update(t + "." + req.rawBody)
    .digest("hex");

  if (!timingSafeEqual(Buffer.from(expected), Buffer.from(v1))) {
    throw new Error("bad signature");
  }
  return JSON.parse(req.rawBody);
}

import hashlib, hmac, time, json

def verify(headers, raw_body, secret):
    sig = headers.get("x-ryte-signature", "")
    parts = dict(p.split("=") for p in sig.split(","))
    t, v1 = parts.get("t"), parts.get("v1")
    if not t or not v1:
        raise ValueError("missing signature")
    if abs(time.time() - int(t)) > 300:
        raise ValueError("signature too old")

    expected = hmac.new(
        secret.encode(),
        f"{t}.{raw_body}".encode(),
        hashlib.sha256,
    ).hexdigest()
    if not hmac.compare_digest(expected, v1):
        raise ValueError("bad signature")
    return json.loads(raw_body)