const express = require('express');
const crypto = require('crypto');

const app = express();

// Use raw body for signature verification
app.post('/webhooks/swiftpay',
express.raw({ type: 'application/json' }),
(req, res) => {
const signature = req.headers['x-webhook-signature'];
const timestamp = req.headers['x-webhook-timestamp'];

    // Verify signature
    if (!verifyWebhookSignature(req.body, signature, timestamp)) {
      return res.status(401).send('Invalid signature');
    }

    const event = JSON.parse(req.body);

    // Handle the event
    switch (event.type) {
      case 'checkout.succeeded':
        handlePaymentSuccess(event.data);
        break;
      case 'checkout.failed':
        handlePaymentFailure(event.data);
        break;
      case 'withdrawal.paid':
        handleWithdrawalPaid(event.data);
        break;
      case 'withdrawal.failed':
        handleWithdrawalFailed(event.data);
        break;
    }

    res.status(200).send('OK');

}
);

from flask import Flask, request
import hmac
import hashlib

app = Flask(__name__)

@app.route('/webhooks/swiftpay', methods=['POST'])
def webhook():
    signature = request.headers.get('X-Webhook-Signature')
    timestamp = request.headers.get('X-Webhook-Timestamp')

    # Verify signature
    if not verify_signature(request.data, signature, timestamp):
        return 'Invalid signature', 401

    event = request.json

    # Handle the event
    if event['type'] == 'checkout.succeeded':
        handle_payment_success(event['data'])
    elif event['type'] == 'checkout.failed':
        handle_payment_failure(event['data'])
    elif event['type'] == 'withdrawal.paid':
        handle_withdrawal_paid(event['data'])
    elif event['type'] == 'withdrawal.failed':
        handle_withdrawal_failed(event['data'])

    return 'OK', 200

<?php
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'];
$timestamp = $_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'];

// Verify signature
if (!verifySignature($payload, $signature, $webhookSecret)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($payload, true);

switch ($event['type']) {
    case 'checkout.succeeded':
        handlePaymentSuccess($event['data']);
        break;
    case 'checkout.failed':
        handlePaymentFailure($event['data']);
        break;
    case 'refund.completed':
        handleRefundCompleted($event['data']);
        break;
    case 'refund.failed':
        handleRefundFailed($event['data']);
        break;
}

http_response_code(200);
echo 'OK';

const crypto = require('crypto');

function verifyWebhookSignature(payload, signatureHeader, secret) {
// 1. Extract timestamp and signature from header
const parts = signatureHeader.split(',');
const timestamp = parts.find(p => p.startsWith('t=')).split('=')[1];
const signature = parts.find(p => p.startsWith('v1=')).split('=')[1];

// 2. Check timestamp is recent (within 5 minutes) to prevent replay attacks
const currentTime = Math.floor(Date.now() / 1000);
if (Math.abs(currentTime - parseInt(timestamp)) > 300) {
return false;
}

// 3. Create the signed payload
const signedPayload = `${timestamp}.${payload}`;

// 4. Calculate expected signature
const expectedSignature = crypto
.createHmac('sha256', secret)
.update(signedPayload)
.digest('hex');

// 5. Compare signatures using constant-time comparison
return crypto.timingSafeEqual(
Buffer.from(signature, 'hex'),
Buffer.from(expectedSignature, 'hex')
);
}

import hmac
import hashlib
import time

def verify_signature(payload, signature_header, secret):
    # 1. Extract timestamp and signature from header
    parts = signature_header.split(',')
    timestamp = next(p.split('=')[1] for p in parts if p.startswith('t='))
    signature = next(p.split('=')[1] for p in parts if p.startswith('v1='))

    # 2. Check timestamp is recent (within 5 minutes)
    current_time = int(time.time())
    if abs(current_time - int(timestamp)) > 300:
        return False

    # 3. Create the signed payload
    signed_payload = f"{timestamp}.{payload.decode()}"

    # 4. Calculate expected signature
    expected_signature = hmac.new(
        secret.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()

    # 5. Compare signatures
    return hmac.compare_digest(signature, expected_signature)

function verifySignature($payload, $signatureHeader, $secret) {
    // 1. Extract timestamp and signature from header
    $parts = explode(',', $signatureHeader);
    $timestamp = "";
    $signature = "";

    foreach ($parts as $part) {
        if (str_starts_with($part, 't=')) {
            $timestamp = substr($part, 2);
        } elseif (str_starts_with($part, 'v1=')) {
            $signature = substr($part, 3);
        }
    }

    // 2. Check timestamp is recent (within 5 minutes)
    $currentTime = time();
    if (abs($currentTime - intval($timestamp)) > 300) {
        return false;
    }

    // 3. Create the signed payload
    $signedPayload = $timestamp . '.' . $payload;

    // 4. Calculate expected signature
    $expectedSignature = hash_hmac('sha256', $signedPayload, $secret);

    // 5. Compare signatures
    return hash_equals($expectedSignature, $signature);
}