const crypto = require('crypto');

function verifyWebhookSignature(rawBody, signature, timestamp, secret) {
  // Reject old timestamps (> 5 minutes)
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - timestamp) > 300) {
    throw new Error('Timestamp too old');
  }

  // Calculate expected signature using raw body (not re-serialized JSON)
  const payloadToSign = `${timestamp}.${rawBody}`;
  const expectedSignature = 'hmac_sha256=' + crypto
    .createHmac('sha256', secret)
    .update(payloadToSign)
    .digest('hex');

  // Compare signatures
  if (!crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  )) {
    throw new Error('Invalid signature');
  }

  return true;
}

// Capture raw body for signature verification
app.use(express.json({
  verify: (req, res, buf) => { req.rawBody = buf.toString(); }
}));

app.post('/webhooks/luxcore', (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const timestamp = parseInt(req.headers['x-webhook-timestamp']);
  const webhookId = req.headers['x-webhook-id'];

  try {
    // Verify using raw body (not re-serialized JSON)
    verifyWebhookSignature(req.rawBody, signature, timestamp, WEBHOOK_SECRET);

    // Process the event — use envelope structure
    const event = req.headers['x-webhook-event'];
    const payment = req.body.data.payment;
    console.log(`Received ${event} for payment ${payment.id} (webhook: ${webhookId})`);

    // Handle specific events
    switch (event) {
      case 'payment.completed':
        // Update order status, send confirmation email, etc.
        break;
      case 'payment.failed':
        // Handle failed payment
        break;
    }

    res.status(200).json({ received: true });
  } catch (error) {
    console.error('Webhook error:', error.message);
    res.status(400).json({ error: error.message });
  }
});

import hmac
import hashlib
import os
import time
from flask import Flask, request, jsonify

app = Flask(__name__)
WEBHOOK_SECRET = os.environ.get('LUXCORE_WEBHOOK_SECRET')

def verify_webhook_signature(raw_body, signature, timestamp, secret):
    # Reject old timestamps (> 5 minutes)
    current_time = int(time.time())
    if abs(current_time - timestamp) > 300:
        raise ValueError('Timestamp too old')

    # Calculate expected signature using raw body (not re-serialized JSON)
    payload_to_sign = f"{timestamp}.{raw_body}"
    expected_signature = 'hmac_sha256=' + hmac.new(
        secret.encode(),
        payload_to_sign.encode(),
        hashlib.sha256
    ).hexdigest()

    # Compare signatures
    if not hmac.compare_digest(signature, expected_signature):
        raise ValueError('Invalid signature')

    return True

@app.route('/webhooks/luxcore', methods=['POST'])
def webhook_handler():
    signature = request.headers.get('X-Webhook-Signature')
    timestamp = int(request.headers.get('X-Webhook-Timestamp'))
    raw_body = request.get_data(as_text=True)
    payload = request.json  # for business logic

    try:
        verify_webhook_signature(raw_body, signature, timestamp, WEBHOOK_SECRET)

        # Process the event — use envelope structure
        event = request.headers.get('X-Webhook-Event')
        webhook_id = request.headers.get('X-Webhook-Id')
        payment = payload['data']['payment']
        print(f"Received {event} for payment {payment['id']} (webhook: {webhook_id})")

        if event == 'payment.completed':
            # Handle completed payment
            pass
        elif event == 'payment.failed':
            # Handle failed payment
            pass

        return jsonify({'received': True}), 200
    except ValueError as e:
        return jsonify({'error': str(e)}), 400

<?php
function verifyWebhookSignature(string $rawBody, string $signature, int $timestamp, string $secret): bool {
    // Reject old timestamps (> 5 minutes)
    $currentTime = time();
    if (abs($currentTime - $timestamp) > 300) {
        throw new InvalidArgumentException('Webhook timestamp too old');
    }

    // Calculate expected signature using raw body (not re-serialized JSON)
    $payloadToSign = "{$timestamp}.{$rawBody}";
    $expectedSignature = 'hmac_sha256=' . hash_hmac('sha256', $payloadToSign, $secret);

    // Compare signatures (timing-safe)
    if (!hash_equals($signature, $expectedSignature)) {
        throw new InvalidArgumentException('Invalid webhook signature');
    }

    return true;
}

// Handle incoming webhook
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$timestamp = (int)($_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? 0);
$rawBody = file_get_contents('php://input');
$payload = json_decode($rawBody, true);

try {
    verifyWebhookSignature($rawBody, $signature, $timestamp, WEBHOOK_SECRET);
    
    // Process event — use envelope structure
    $event = $_SERVER['HTTP_X_WEBHOOK_EVENT'] ?? '';
    $webhookId = $_SERVER['HTTP_X_WEBHOOK_ID'] ?? '';
    $payment = $payload['data']['payment'];

    switch ($event) {
        case 'payment.completed':
            // Handle completed payment
            break;
        case 'payment.failed':
            // Handle failed payment
            break;
    }

    http_response_code(200);
    echo json_encode(['received' => true]);
} catch (Exception $e) {
    http_response_code(400);
    echo json_encode(['error' => $e->getMessage()]);
}

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io"
    "math"
    "net/http"
    "strconv"
    "time"
)

func verifyWebhookSignature(payload []byte, signature string, timestamp int64, secret string) error {
    // Reject old timestamps (> 5 minutes)
    currentTime := time.Now().Unix()
    if math.Abs(float64(currentTime-timestamp)) > 300 {
        return fmt.Errorf("timestamp too old")
    }

    // Calculate expected signature using raw body bytes
    payloadToSign := fmt.Sprintf("%d.%s", timestamp, string(payload))
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(payloadToSign))
    expectedSignature := "hmac_sha256=" + hex.EncodeToString(mac.Sum(nil))

    // Compare signatures
    if !hmac.Equal([]byte(signature), []byte(expectedSignature)) {
        return fmt.Errorf("invalid signature")
    }

    return nil
}

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    // Read raw body first for signature verification
    body, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "Failed to read body", http.StatusBadRequest)
        return
    }

    signature := r.Header.Get("X-Webhook-Signature")
    timestampStr := r.Header.Get("X-Webhook-Timestamp")
    timestamp, _ := strconv.ParseInt(timestampStr, 10, 64)

    // Verify using raw body (not re-serialized JSON)
    if err := verifyWebhookSignature(body, signature, timestamp, webhookSecret); err != nil {
        http.Error(w, err.Error(), http.StatusBadRequest)
        return
    }

    // Parse for business logic
    var payload map[string]interface{}
    json.Unmarshal(body, &payload)

    // Process the event — use envelope structure
    event := r.Header.Get("X-Webhook-Event")
    webhookId := r.Header.Get("X-Webhook-Id")
    data := payload["data"].(map[string]interface{})
    payment := data["payment"].(map[string]interface{})
    fmt.Printf("Received %s for payment %s (webhook: %s)\n", event, payment["id"], webhookId)

    w.WriteHeader(http.StatusOK)
    json.NewEncoder(w).Encode(map[string]bool{"received": true})
}