Webhooks

const crypto = require("crypto");

// express.raw() keeps the body as a Buffer — express.json() would not.
app.post("/webhooks/esim", express.raw({ type: "application/json" }), (req, res) => {
  const rawBody = req.body.toString("utf8");
  const timestamp = req.get("X-Esim-Story-Webhook-Timestamp");
  const header = req.get("X-Esim-Story-Webhook-Signature") || "";

  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return res.sendStatus(401);
  }

  const expected = crypto
    .createHmac("sha256", process.env.ESIM_STORY_WEBHOOK_SECRET)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const matched = header.split(",").some((candidate) => {
    const received = Buffer.from(candidate.trim(), "utf8");
    const computed = Buffer.from(expected, "utf8");

    return (
      received.length === computed.length &&
      crypto.timingSafeEqual(received, computed)
    );
  });

  if (!matched) return res.sendStatus(401);

  // Acknowledge first, process asynchronously. Deliveries are retried, so
  // enqueue() should ignore a topup_id it has already handled.
  res.sendStatus(200);
  enqueue(JSON.parse(rawBody));
});

import hashlib
import hmac
import os
import time

from flask import Flask, request

app = Flask(__name__)


@app.post("/webhooks/esim")
def esim_webhook():
    raw_body = request.get_data(as_text=True)
    timestamp = request.headers.get("X-Esim-Story-Webhook-Timestamp", "")
    header = request.headers.get("X-Esim-Story-Webhook-Signature", "")

    if abs(time.time() - int(timestamp)) > 300:
        return "", 401

    expected = hmac.new(
        os.environ["ESIM_STORY_WEBHOOK_SECRET"].encode(),
        f"{timestamp}.{raw_body}".encode(),
        hashlib.sha256,
    ).hexdigest()

    if not any(
        hmac.compare_digest(expected, candidate.strip())
        for candidate in header.split(",")
    ):
        return "", 401

    # Deliveries are retried, so enqueue() should ignore a topup_id it has
    # already handled.
    enqueue(request.get_json())

    return "", 200

require "openssl"
require "rack/utils"

post "/webhooks/esim" do
  raw_body = request.body.read
  timestamp = request.env["HTTP_X_ESIM_STORY_WEBHOOK_TIMESTAMP"].to_s
  header = request.env["HTTP_X_ESIM_STORY_WEBHOOK_SIGNATURE"].to_s

  halt 401 if (Time.now.to_i - timestamp.to_i).abs > 300

  expected = OpenSSL::HMAC.hexdigest(
    "SHA256",
    ENV.fetch("ESIM_STORY_WEBHOOK_SECRET"),
    "#{timestamp}.#{raw_body}"
  )

  matched = header.split(",").any? do |candidate|
    Rack::Utils.secure_compare(expected, candidate.strip)
  end

  halt 401 unless matched

  # Deliveries are retried, so enqueue() should ignore a topup_id it has
  # already handled.
  enqueue(JSON.parse(raw_body))

  status 200
end