const crypto = require("crypto");
const express = require("express");
const app = express();
const WEBHOOK_SECRET = process.env.LUXCORE_WEBHOOK_SECRET;

function verifyWebhookSignature(rawBody, signature, timestamp, secret) {
  // Reject old timestamps (> 5 minutes)
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - timestamp) > 300) {
    throw new Error("Timestamp too old");
  }

  // Calculate expected signature using raw body (not re-serialized JSON)
  const payloadToSign = `${timestamp}.${rawBody}`;
  const expectedSignature =
    "hmac_sha256=" +
    crypto.createHmac("sha256", secret).update(payloadToSign).digest("hex");

  // Compare signatures
  if (
    !crypto.timingSafeEqual(
      Buffer.from(signature),
      Buffer.from(expectedSignature),
    )
  ) {
    throw new Error("Invalid signature");
  }

  return true;
}

// Capture raw body for signature verification
app.use(
  express.json({
    verify: (req, res, buf) => {
      req.rawBody = buf.toString();
    },
  }),
);

app.post("/webhooks/luxcore", (req, res) => {
  const signature = req.headers["x-webhook-signature"];
  const timestamp = parseInt(req.headers["x-webhook-timestamp"]);
  const webhookId = req.headers["x-webhook-id"];

  try {
    // Verify using raw body (not re-serialized JSON)
    verifyWebhookSignature(req.rawBody, signature, timestamp, WEBHOOK_SECRET);

    // Process the event — use envelope structure
    if (req.headers["x-webhook-test"] === "true" || !req.body?.data?.payment) {
      return res.status(200).json({ received: true });
    }
    const event = `payment.${req.body.data.payment.status}`;
    const payment = req.body.data.payment;
    console.log(
      `Received ${event} for payment ${payment.id} (webhook: ${webhookId})`,
    );

    // Handle specific events
    switch (event) {
      case "payment.completed":
        // Update order status, send confirmation email, etc.
        break;
      case "payment.failed":
        // Handle failed payment
        break;
    }

    res.status(200).json({ received: true });
  } catch (error) {
    console.error("Webhook error:", error.message);
    res.status(400).json({ error: error.message });
  }
});

import hmac
import hashlib
import os
import time
from flask import Flask, request, jsonify

app = Flask(__name__)
WEBHOOK_SECRET = os.environ.get('LUXCORE_WEBHOOK_SECRET')

def verify_webhook_signature(raw_body, signature, timestamp, secret):
    # Reject old timestamps (> 5 minutes)
    current_time = int(time.time())
    if abs(current_time - timestamp) > 300:
        raise ValueError('Timestamp too old')

    # Calculate expected signature using raw body (not re-serialized JSON)
    payload_to_sign = f"{timestamp}.{raw_body}"
    expected_signature = 'hmac_sha256=' + hmac.new(
        secret.encode(),
        payload_to_sign.encode(),
        hashlib.sha256
    ).hexdigest()

    # Compare signatures
    if not hmac.compare_digest(signature, expected_signature):
        raise ValueError('Invalid signature')

    return True

@app.route('/webhooks/luxcore', methods=['POST'])
def webhook_handler():
    signature = request.headers.get('X-Webhook-Signature')
    timestamp = int(request.headers.get('X-Webhook-Timestamp'))
    raw_body = request.get_data(as_text=True)
    payload = request.json  # for business logic

    try:
        verify_webhook_signature(raw_body, signature, timestamp, WEBHOOK_SECRET)

        # Process the event — use envelope structure
        if request.headers.get('X-Webhook-Test') == 'true' or not payload.get('data', {}).get('payment'):
            return jsonify({'received': True}), 200
        event = 'payment.' + payload['data']['payment']['status']
        webhook_id = request.headers.get('X-Webhook-Id')
        payment = payload['data']['payment']
        print(f"Received {event} for payment {payment['id']} (webhook: {webhook_id})")

        if event == 'payment.completed':
            # Handle completed payment
            pass
        elif event == 'payment.failed':
            # Handle failed payment
            pass

        return jsonify({'received': True}), 200
    except ValueError as e:
        return jsonify({'error': str(e)}), 400

<?php
function verifyWebhookSignature(string $rawBody, string $signature, int $timestamp, string $secret): bool {
    // Reject old timestamps (> 5 minutes)
    $currentTime = time();
    if (abs($currentTime - $timestamp) > 300) {
        throw new InvalidArgumentException('Webhook timestamp too old');
    }

    // Calculate expected signature using raw body (not re-serialized JSON)
    $payloadToSign = "{$timestamp}.{$rawBody}";
    $expectedSignature = 'hmac_sha256=' . hash_hmac('sha256', $payloadToSign, $secret);

    // Compare signatures (timing-safe)
    if (!hash_equals($signature, $expectedSignature)) {
        throw new InvalidArgumentException('Invalid webhook signature');
    }

    return true;
}

// Handle incoming webhook
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$timestamp = (int)($_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? 0);
$rawBody = file_get_contents('php://input');
$payload = json_decode($rawBody, true);

try {
    verifyWebhookSignature($rawBody, $signature, $timestamp, getenv('LUXCORE_WEBHOOK_SECRET'));

    // Payment examples: persist/deduplicate the envelope id before applying business effects
    if (($_SERVER['HTTP_X_WEBHOOK_TEST'] ?? '') === 'true' || empty($payload['data']['payment'])) {
        http_response_code(200);
        echo json_encode(['received' => true]);
        return;
    }
    $event = 'payment.' . $payload['data']['payment']['status'];
    $webhookId = $_SERVER['HTTP_X_WEBHOOK_ID'] ?? '';
    $payment = $payload['data']['payment'];

    switch ($event) {
        case 'payment.completed':
            // Handle completed payment
            break;
        case 'payment.failed':
            // Handle failed payment
            break;
    }

    http_response_code(200);
    echo json_encode(['received' => true]);
} catch (Exception $e) {
    http_response_code(400);
    echo json_encode(['error' => $e->getMessage()]);
}

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io"
    "math"
    "net/http"
    "os"
    "strconv"
    "time"
)

func verifyWebhookSignature(payload []byte, signature string, timestamp int64, secret string) error {
    // Reject old timestamps (> 5 minutes)
    currentTime := time.Now().Unix()
    if math.Abs(float64(currentTime-timestamp)) > 300 {
        return fmt.Errorf("timestamp too old")
    }

    // Calculate expected signature using raw body bytes
    payloadToSign := fmt.Sprintf("%d.%s", timestamp, string(payload))
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(payloadToSign))
    expectedSignature := "hmac_sha256=" + hex.EncodeToString(mac.Sum(nil))

    // Compare signatures
    if !hmac.Equal([]byte(signature), []byte(expectedSignature)) {
        return fmt.Errorf("invalid signature")
    }

    return nil
}

var webhookSecret = os.Getenv("LUXCORE_WEBHOOK_SECRET")

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    // Read raw body first for signature verification
    body, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "Failed to read body", http.StatusBadRequest)
        return
    }

    signature := r.Header.Get("X-Webhook-Signature")
    timestampStr := r.Header.Get("X-Webhook-Timestamp")
    timestamp, _ := strconv.ParseInt(timestampStr, 10, 64)

    // Verify using raw body (not re-serialized JSON)
    if err := verifyWebhookSignature(body, signature, timestamp, webhookSecret); err != nil {
        http.Error(w, err.Error(), http.StatusBadRequest)
        return
    }

    // Parse only the fields used by this payment-notification example.
    var payload struct {
        ID string `json:"id"`
        Data struct {
            Payment *struct {
                ID string `json:"id"`
                Status string `json:"status"`
            } `json:"payment"`
        } `json:"data"`
    }
    if err := json.Unmarshal(body, &payload); err != nil {
        http.Error(w, "Invalid JSON", http.StatusBadRequest)
        return
    }
    if r.Header.Get("X-Webhook-Test") == "true" || payload.Data.Payment == nil {
        w.WriteHeader(http.StatusOK)
        return
    }
    // Persist/deduplicate payload.ID before applying business effects.
    event := "payment." + payload.Data.Payment.Status
    fmt.Printf("Received %s for payment %s (webhook: %s)\n", event, payload.Data.Payment.ID, payload.ID)

    w.WriteHeader(http.StatusOK)
    json.NewEncoder(w).Encode(map[string]bool{"received": true})
}