Callbacks

import { createHmac, timingSafeEqual } from 'node:crypto'

function verify(req, rawBody) {
  const ts = req.headers['x-pontis-timestamp']
  const sig = req.headers['x-pontis-signature']      // "sha256=<hex>"
  if (typeof sig !== 'string' || !sig.startsWith('sha256=')) return false

  // 1) freshness — reject if older than 5 minutes
  const age = Math.floor(Date.now() / 1000) - Number(ts)
  if (!Number.isFinite(age) || age > 300) return false

  // 2) signature
  const key = Buffer.from(HMAC_SECRET, 'base64url')
  const expected = createHmac('sha256', key).update(`${ts}.${rawBody}`).digest('hex')
  const a = Buffer.from(sig.slice(7), 'hex')
  const b = Buffer.from(expected, 'hex')
  return a.length === b.length && timingSafeEqual(a, b)
}

import base64, hmac, hashlib, time

def b64url_decode(s):
    pad = '=' * (-len(s) % 4)
    return base64.urlsafe_b64decode(s + pad)

def verify(headers, raw_body, hmac_secret):
    ts = headers.get('x-pontis-timestamp', '')
    sig = headers.get('x-pontis-signature', '')
    if not sig.startswith('sha256='):
        return False

    # 1) freshness — reject if older than 5 minutes
    try:
        age = int(time.time()) - int(ts)
    except ValueError:
        return False
    if age > 300:
        return False

    # 2) signature
    key = b64url_decode(hmac_secret)
    expected = hmac.new(key, f"{ts}.{raw_body}".encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(sig[7:], expected)