Webhooks

const crypto = require('crypto');

// Important : récupérer le corps BRUT, pas l'objet parsé
app.post('/hooks/0flaw', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('X-0flaw-Signature') || '';
  const { t, v1 } = Object.fromEntries(header.split(',').map((p) => p.split('=')));

  // 1. Rejeter les livraisons trop anciennes (protection anti-rejeu)
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return res.sendStatus(400);

  // 2. Recalculer la signature
  const expected = crypto
    .createHmac('sha256', process.env.OFLAW_WEBHOOK_SECRET)
    .update(`${t}.${req.body}`)
    .digest('hex');

  // 3. Comparer en temps constant
  const ok =
    v1.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(v1, 'hex'), Buffer.from(expected, 'hex'));
  if (!ok) return res.sendStatus(401);

  const event = JSON.parse(req.body.toString('utf8'));
  // … traitez l'événement, puis répondez rapidement
  res.sendStatus(200);
});

import hmac, hashlib, time
from flask import request, abort

@app.post("/hooks/0flaw")
def oflaw_webhook():
    header = request.headers.get("X-0flaw-Signature", "")
    parts = dict(p.split("=", 1) for p in header.split(","))
    t, v1 = parts.get("t", ""), parts.get("v1", "")

    # 1. Anti-rejeu : tolérance de 5 minutes
    if abs(time.time() - int(t)) > 300:
        abort(400)

    # 2. Recalcul sur le corps BRUT
    raw = request.get_data()
    expected = hmac.new(
        OFLAW_WEBHOOK_SECRET.encode(),
        f"{t}.".encode() + raw,
        hashlib.sha256,
    ).hexdigest()

    # 3. Comparaison en temps constant
    if not hmac.compare_digest(v1, expected):
        abort(401)

    event = request.get_json()
    return "", 200