Webhooks: payment.paid

import { createHmac, timingSafeEqual } from 'node:crypto'

const TOLERANCE_SECONDS = 5 * 60

/** header: the X-NervixPay-Signature value. rawBody: the exact bytes you received (string or Buffer). */
export function verifyNervixPaySignature(secret, header, rawBody, now = Math.floor(Date.now() / 1000)) {
  if (!secret || typeof header !== 'string') return false
  const parts = header.split(',').map((part) => part.trim())
  const timestamp = Number((parts.find((part) => part.startsWith('t=')) || '').slice(2))
  const signatures = parts.filter((part) => part.startsWith('v1=')).map((part) => part.slice(3))
  if (!Number.isSafeInteger(timestamp) || signatures.length === 0) return false
  if (Math.abs(now - timestamp) > TOLERANCE_SECONDS) return false
  const expected = createHmac('sha256', secret).update(timestamp + '.').update(rawBody).digest()
  return signatures.some((signature) => {
    const candidate = Buffer.from(signature, 'hex')
    return candidate.length === expected.length && timingSafeEqual(candidate, expected)
  })
}

import express from 'express'
import { verifyNervixPaySignature } from './verify-nervixpay.mjs'

const app = express()

app.post('/webhooks/nervixpay', express.raw({ type: 'application/json' }), async (req, res) => {
  const signature = req.get('X-NervixPay-Signature')
  if (!verifyNervixPaySignature(process.env.NERVIXPAY_WEBHOOK_SECRET, signature, req.body)) {
    return res.status(401).end()
  }
  const event = JSON.parse(req.body.toString('utf8'))
  if (event.event === 'payment.paid') {
    // Idempotent: skip if you already processed event.orderId, then credit event.customerReference.
    await markOrderPaid(event)
  }
  res.status(200).end()
})

import { verifyWebhookSignature, WEBHOOK_SIGNATURE_HEADER } from '@nervixpay/integration'

// rawBody must be the unparsed request body (string or Buffer).
const valid = verifyWebhookSignature(process.env.NERVIXPAY_WEBHOOK_SECRET, request.headers[WEBHOOK_SIGNATURE_HEADER], rawBody)

import hashlib
import hmac
import time

TOLERANCE_SECONDS = 5 * 60


def verify_nervixpay_signature(secret: str, header: str, raw_body: bytes, now: int | None = None) -> bool:
    """header: the X-NervixPay-Signature value. raw_body: the exact request bytes."""
    if not secret or not header:
        return False
    parts = [part.strip() for part in header.split(",")]
    timestamps = [part[2:] for part in parts if part.startswith("t=")]
    signatures = [part[3:] for part in parts if part.startswith("v1=")]
    if not timestamps or not timestamps[0].isdigit() or not signatures:
        return False
    timestamp = int(timestamps[0])
    current = int(time.time()) if now is None else now
    if abs(current - timestamp) > TOLERANCE_SECONDS:
        return False
    signed = str(timestamp).encode() + b"." + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(expected, signature) for signature in signatures)


# Flask example:
# @app.post("/webhooks/nervixpay")
# def nervixpay_webhook():
#     if not verify_nervixpay_signature(os.environ["NERVIXPAY_WEBHOOK_SECRET"],
#                                       request.headers.get("X-NervixPay-Signature", ""),
#                                       request.get_data()):
#         abort(401)
#     event = request.get_json()
#     ...  # idempotent by event["orderId"]
#     return "", 200

<?php
const NERVIXPAY_TOLERANCE_SECONDS = 300;

/** $header: the X-NervixPay-Signature value. $rawBody: file_get_contents('php://input'). */
function verify_nervixpay_signature(string $secret, string $header, string $rawBody, ?int $now = null): bool
{
    if ($secret === '' || $header === '') {
        return false;
    }
    $timestamp = null;
    $signatures = [];
    foreach (explode(',', $header) as $part) {
        $part = trim($part);
        if (str_starts_with($part, 't=') && ctype_digit(substr($part, 2))) {
            $timestamp = (int) substr($part, 2);
        } elseif (str_starts_with($part, 'v1=')) {
            $signatures[] = substr($part, 3);
        }
    }
    if ($timestamp === null || $signatures === []) {
        return false;
    }
    if (abs(($now ?? time()) - $timestamp) > NERVIXPAY_TOLERANCE_SECONDS) {
        return false;
    }
    $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    foreach ($signatures as $signature) {
        if (hash_equals($expected, $signature)) {
            return true;
        }
    }
    return false;
}

// Usage:
// $valid = verify_nervixpay_signature(getenv('NERVIXPAY_WEBHOOK_SECRET'),
//     $_SERVER['HTTP_X_NERVIXPAY_SIGNATURE'] ?? '', file_get_contents('php://input'));
// if (!$valid) { http_response_code(401); exit; }