Verify signatures

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.USERTICK_WEBHOOK_SECRET; // whsec_...
const KEY = Buffer.from(SECRET.slice("whsec_".length), "base64");
const TOLERANCE_SECONDS = 5 * 60;

// express.raw keeps the body as a Buffer, byte for byte.
app.post("/hooks/usertick", express.raw({ type: "application/json" }), (req, res) => {
  const id = req.header("webhook-id");
  const timestamp = req.header("webhook-timestamp");
  const signatures = req.header("webhook-signature") ?? "";
  if (!id || !timestamp) return res.status(400).end();

  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!(age <= TOLERANCE_SECONDS)) return res.status(401).end();

  const expected = crypto
    .createHmac("sha256", KEY)
    .update(`${id}.${timestamp}.`)
    .update(req.body)
    .digest("base64");

  const valid = signatures.split(" ").some((entry) => {
    const [version, signature] = entry.split(",");
    return (
      version === "v1" &&
      signature?.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
    );
  });
  if (!valid) return res.status(401).end();

  res.status(200).end(); // answer first, then do the work
  const event = JSON.parse(req.body.toString("utf8"));
  console.log(req.header("X-Usertick-Event"), event.id);
});

import base64, hashlib, hmac, os, time
from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ["USERTICK_WEBHOOK_SECRET"]  # whsec_...
KEY = base64.b64decode(SECRET.removeprefix("whsec_"))
TOLERANCE_SECONDS = 5 * 60

@app.post("/hooks/usertick")
def usertick_hook():
    msg_id = request.headers.get("webhook-id", "")
    timestamp = request.headers.get("webhook-timestamp", "")
    signatures = request.headers.get("webhook-signature", "")
    if not msg_id or not timestamp.isdigit():
        return "", 400
    if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        return "", 401

    signed = f"{msg_id}.{timestamp}.".encode() + request.get_data()  # raw bytes
    expected = base64.b64encode(hmac.new(KEY, signed, hashlib.sha256).digest()).decode()

    valid = any(
        version == "v1" and hmac.compare_digest(signature, expected)
        for version, _, signature in (entry.partition(",") for entry in signatures.split(" "))
    )
    if not valid:
        return "", 401

    event = request.get_json()
    print(request.headers.get("X-Usertick-Event"), event["id"])
    return "", 200