Webhooks

import crypto from 'crypto';

function verificarWebhook(payload: string, signature: string, secret: string): boolean {
  const esperado = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(esperado, 'hex')
  );
}

// Em Express:
app.post('/webhook/cordialy', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-cordialy-signature'] as string;
  const valido = verificarWebhook(req.body.toString(), signature, process.env.WEBHOOK_SECRET);

  if (!valido) return res.status(401).json({ error: 'Assinatura inválida' });

  const evento = JSON.parse(req.body.toString());
  // processa evento...

  res.status(200).json({ received: true });
});

import hmac, hashlib

def verificar_webhook(payload: bytes, signature: str, secret: str) -> bool:
    esperado = hmac.new(
        secret.encode(), payload, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, esperado)

# Em Flask:
@app.route('/webhook/cordialy', methods=['POST'])
def webhook():
    signature = request.headers.get('X-Cordialy-Signature', '')
    if not verificar_webhook(request.data, signature, os.environ['WEBHOOK_SECRET']):
        return {'error': 'Assinatura inválida'}, 401

    evento = request.json
    # processa evento...
    return {'received': True}