Webhooks

import { createHmac, timingSafeEqual } from 'node:crypto';
import { createServer } from 'node:http';

export function verifyHyoMailSignature(rawBody: string, header: string, secret: string, toleranceSeconds = 300): boolean {
  const parts = header.split(',').map((p) => p.trim());
  const t = parts.find((p) => p.startsWith('t='))?.slice(2) ?? '';
  const signatures = parts.filter((p) => p.startsWith('v1=')).map((p) => p.slice(3));
  if (!/^\d+$/.test(t) || signatures.length === 0) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - Number(t)) > toleranceSeconds) return false;
  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest();
  return signatures.some((s) => {
    const given = Buffer.from(s, 'hex');
    return given.length === expected.length && timingSafeEqual(given, expected);
  });
}

createServer((req, res) => {
  const chunks: Buffer[] = [];
  req.on('data', (chunk) => chunks.push(chunk));
  req.on('end', () => {
    const raw = Buffer.concat(chunks).toString('utf8');
    const header = String(req.headers['hyonova-signature'] ?? '');
    if (!verifyHyoMailSignature(raw, header, process.env.HYO_MAIL_WEBHOOK_SECRET!)) {
      res.writeHead(400).end();
      return;
    }
    const event = JSON.parse(raw); // { id, event, occurredAt, data }
    // Ignore event.id if you have already handled it, then queue the work.
    res.writeHead(200).end();
  });
}).listen(3000);

<?php
function hyo_mail_verify(string $rawBody, string $header, string $secret, int $tolerance = 300): bool
{
    $timestamp = '';
    $signatures = [];
    foreach (explode(',', $header) as $part) {
        $pair = explode('=', trim($part), 2);
        if (count($pair) !== 2) {
            continue;
        }
        if ($pair[0] === 't') {
            $timestamp = $pair[1];
        } elseif ($pair[0] === 'v1') {
            $signatures[] = $pair[1];
        }
    }
    if (!ctype_digit($timestamp) || !$signatures || abs(time() - (int) $timestamp) > $tolerance) {
        return false;
    }
    $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    foreach ($signatures as $signature) {
        if (hash_equals($expected, $signature)) {
            return true;
        }
    }
    return false;
}

$raw = file_get_contents('php://input');
$header = $_SERVER['HTTP_HYONOVA_SIGNATURE'] ?? '';
if (!hyo_mail_verify($raw, $header, getenv('HYO_MAIL_WEBHOOK_SECRET'))) {
    http_response_code(400);
    exit;
}
$event = json_decode($raw, true); // ['id' => ..., 'event' => ..., 'data' => ...]
// Ignore $event['id'] if you have already handled it, then queue the work.
http_response_code(200);

# BODY is the raw request body, T is the t= value from HyoNova-Signature
printf '%s.%s' "$T" "$BODY" | openssl dgst -sha256 -hmac "$HYO_MAIL_WEBHOOK_SECRET" -hex
# Compare the result with the v1= value(s)