Webhooks

import hashlib, hmac, time
from flask import Flask, request, abort

app = Flask(__name__)
WEBHOOK_SECRET = "whsec_your_secret_here"
MAX_AGE_SECONDS = 300  # Reject deliveries older than 5 minutes

def verify_webhook(payload: bytes, signature_header: str, secret: str) -> bool:
    """Verify a Danube webhook signature with replay protection.

    Signature format: t={unix_timestamp},sha256={hex_digest}
    Signed content:   {timestamp}.{payload}
    """
    parts = dict(p.split("=", 1) for p in signature_header.split(",") if "=" in p)
    ts = parts.get("t", "")
    sig = parts.get("sha256", "")

    if not ts or not sig:
        return False

    # Reject old deliveries to prevent replay attacks
    if abs(time.time() - int(ts)) > MAX_AGE_SECONDS:
        return False

    signed_content = f"{ts}.{payload.decode()}"
    expected = hmac.new(
        secret.encode(), signed_content.encode(), hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(expected, sig)

@app.route("/webhooks/danube", methods=["POST"])
def handle_webhook():
    payload = request.data
    signature = request.headers.get("X-Danube-Signature", "")

    if not verify_webhook(payload, signature, WEBHOOK_SECRET):
        abort(401)

    event = request.json
    print(f"{event['event']}: {event['data']}")
    return "", 200