Webhooks

// Verifying a Bref Point Inbox webhook — copy it into your server (Node.js ≥ 18, no dependencies).
//
// The `BrefPoint-Signature` header looks like: t=<seconds>,v1=<hmac-sha256-hex>
// The signature covers the string  "<t>.<raw body>"  using the endpoint's `whsec_…` secret.
import { createHmac, timingSafeEqual } from 'node:crypto';

/**
 * @param {string|Buffer} rawBody  the EXACT body received (before any JSON.parse)
 * @param {string} header          value of the BrefPoint-Signature header
 * @param {string} secret          the endpoint's whsec_… secret
 * @param {number} toleranceSeconds maximum accepted age (protects against replay), 300 s by default
 */
export function verifyWebhook(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries((header ?? '').split(',').map((p) => p.split('=')));
  const t = Number(parts.t);
  if (!Number.isFinite(t) || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;
  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest();
  const given = Buffer.from(parts.v1, 'hex');
  return given.length === expected.length && timingSafeEqual(given, expected);
}

// Exemple avec Express :
//   app.post('/webhooks/inbox', express.raw({ type: 'application/json' }), (req, res) => {
//     if (!verifyWebhook(req.body, req.get('BrefPoint-Signature'), process.env.INBOX_WEBHOOK_SECRET)) return res.sendStatus(401);
//     const event = JSON.parse(req.body);      // { id, type, createdAt, data }
//     // `event.id` is stable: if it comes back (retry, replay), ignore it if already processed.
//     res.sendStatus(200);                     // answer fast (2xx), process afterwards
//   });

# Verifying a Bref Point Inbox webhook — Python 3, no dependencies.
# BrefPoint-Signature header: t=<seconds>,v1=<hmac-sha256-hex>; the signature covers "<t>.<raw body>".
import hashlib
import hmac
import time


def verify_webhook(raw_body: bytes, header: str, secret: str, tolerance_seconds: int = 300) -> bool:
    """raw_body: the EXACT body received (bytes), before any json.loads."""
    try:
        parts = dict(p.split("=", 1) for p in header.split(","))
        t = int(parts["t"])
        v1 = parts["v1"]
    except (KeyError, ValueError, AttributeError):
        return False
    if abs(time.time() - t) > tolerance_seconds:  # envoi trop ancien : rejeu possible
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)


# Exemple avec Flask :
#   @app.post("/webhooks/inbox")
#   def inbox_webhook():
#       if not verify_webhook(request.get_data(), request.headers.get("BrefPoint-Signature", ""), SECRET):
#           return "", 401
#       event = request.get_json()        # { id, type, createdAt, data }
#       # event["id"] is stable: ignore it if already processed (retry, replay)
#       return "", 200                    # answer fast (2xx), process afterwards

<?php
// Verifying a Bref Point Inbox webhook — PHP 7.4+, no dependencies.
// BrefPoint-Signature header: t=<seconds>,v1=<hmac-sha256-hex>; the signature covers "<t>.<raw body>".

/**
 * @param string      $rawBody   the EXACT body received: file_get_contents('php://input'), before json_decode
 * @param string|null $header    value of the BrefPoint-Signature header
 * @param string      $secret    the endpoint's whsec_… secret
 */
function verifyWebhook(string $rawBody, ?string $header, string $secret, int $toleranceSeconds = 300): bool
{
    if (!$header) {
        return false;
    }
    $parts = [];
    foreach (explode(',', $header) as $part) {
        [$key, $value] = array_pad(explode('=', $part, 2), 2, '');
        $parts[$key] = $value;
    }
    if (!isset($parts['t'], $parts['v1']) || !ctype_digit($parts['t'])) {
        return false;
    }
    if (abs(time() - (int) $parts['t']) > $toleranceSeconds) { // envoi trop ancien : rejeu possible
        return false;
    }
    $expected = hash_hmac('sha256', $parts['t'] . '.' . $rawBody, $secret);
    return hash_equals($expected, $parts['v1']);
}

// Utilisation :
//   $raw = file_get_contents('php://input');
//   if (!verifyWebhook($raw, $_SERVER['HTTP_BREFPOINT_SIGNATURE'] ?? null, getenv('INBOX_WEBHOOK_SECRET'))) {
//       http_response_code(401); exit;
//   }
//   $event = json_decode($raw, true);   // { id, type, createdAt, data } — `id` is stable: deduplicate on it
//   http_response_code(200);            // answer fast (2xx), process afterwards