import hashlib
import hmac
import json

WEBHOOK_SECRET = "your_webhook_secret"

def verify_webhook(raw_body: bytes, webhook_secret: str, received_hash: str) -> bool:
    expected = hashlib.sha512(raw_body + webhook_secret.encode()).hexdigest()
    return hmac.compare_digest(expected, received_hash or "")

# Flask-style handler
raw_body = request.get_data()
received_hash = request.headers.get("X-Data-Hash")

if not verify_webhook(raw_body, WEBHOOK_SECRET, received_hash):
    return {"error": "Invalid signature"}, 400

payload = json.loads(raw_body)
payment = payload["data"]["result"]["payment"]
status = payment["status"]["status"]

const crypto = require("crypto");
const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET || "your_webhook_secret";

function safeCompareHex(expected, received) {
  if (!/^[a-f0-9]{128}$/i.test(received || "")) {
    return false;
  }
  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(received, "hex"),
  );
}

function verifyWebhook(rawBodyBuffer, webhookSecret, receivedHash) {
  const expected = crypto
    .createHash("sha512")
    .update(Buffer.concat([rawBodyBuffer, Buffer.from(webhookSecret)]))
    .digest("hex");

  return safeCompareHex(expected, receivedHash);
}

function verifyWebhookV3(rawBodyBuffer, webhookSecret, headers) {
  const timestamp = headers["x-webhook-timestamp"];
  const nonce = headers["x-webhook-nonce"];
  const webhookId = headers["x-webhook-id"];
  const signature = headers["x-webhook-signature-v3"];
  const timestampMs = Date.parse(timestamp || "");

  if (!timestamp || !nonce || !webhookId || !Number.isFinite(timestampMs)) {
    return false;
  }
  if (Math.abs(Date.now() - timestampMs) > 5 * 60 * 1000) {
    return false;
  }

  const expected = crypto
    .createHmac("sha512", webhookSecret)
    .update(
      [timestamp, nonce, webhookId, rawBodyBuffer.toString("utf8")].join("."),
    )
    .digest("hex");

  return safeCompareHex(expected, signature);
}

// Express example:
// app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
//   const valid =
//     verifyWebhookV3(req.body, WEBHOOK_SECRET, req.headers) ||
//     verifyWebhook(req.body, WEBHOOK_SECRET, req.headers['x-data-hash']);
//
//   if (!valid) {
//     return res.status(400).json({ error: 'Invalid signature' });
//   }
//
//   const payload = JSON.parse(req.body.toString('utf8'));
//   const payment = payload.data.result.payment;
//   const status = payment.status.status;
//
//   res.status(200).json({ received: true });
// });

<?php
$webhookSecret = getenv('WEBHOOK_SECRET') ?: 'your_webhook_secret';

function verifyWebhook(string $rawBody, string $webhookSecret, string $receivedHash): bool {
    $expected = hash('sha512', $rawBody . $webhookSecret);
    return hash_equals($expected, $receivedHash);
}

$rawBody = file_get_contents('php://input');
$receivedHash = $_SERVER['HTTP_X_DATA_HASH'] ?? '';

if (!verifyWebhook($rawBody, $webhookSecret, $receivedHash)) {
    http_response_code(400);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

$payload = json_decode($rawBody, true);
$payment = $payload['data']['result']['payment'];