Webhooks

const crypto = require('crypto');

// Verify a Nunua Pro webhook. `rawBody` must be the RAW request body (a Buffer or string),
// not JSON.parse'd and re-stringified. (Express: express.raw({ type: 'application/json' }).)
function verifyNunuaWebhook(rawBody, timestamp, signatureHeader, secret, tolerance = 300) {
  // Reject old requests so a captured one cannot be replayed later.
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > tolerance) return false;
  const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(`${timestamp}.`).update(rawBody).digest('hex');
  const a = Buffer.from(expected);
  const b = Buffer.from(signatureHeader || '');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

module.exports = { verifyNunuaWebhook };

// In your endpoint:
//   const ok = verifyNunuaWebhook(req.body, req.get('X-Nunua-Timestamp'), req.get('X-Nunua-Signature'), process.env.NUNUA_WEBHOOK_SECRET);
//   if (!ok) return res.sendStatus(401);
//   ...record the sale, then answer 2xx quickly.

import hashlib
import hmac
import time


def verify_nunua_webhook(raw_body: bytes, timestamp: str, signature_header: str, secret: str, tolerance: int = 300) -> bool:
    """Verify a Nunua Pro webhook. Pass the RAW request body (bytes), not a re-encoded dict."""
    # Reject old requests so a captured one cannot be replayed later.
    if abs(time.time() - int(timestamp)) > tolerance:
        return False
    signed = timestamp.encode() + b"." + raw_body
    expected = "sha256=" + hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature_header)


# In your endpoint (Flask example):
#   ok = verify_nunua_webhook(
#       request.get_data(),
#       request.headers.get("X-Nunua-Timestamp", ""),
#       request.headers.get("X-Nunua-Signature", ""),
#       os.environ["NUNUA_WEBHOOK_SECRET"],
#   )
#   if not ok: abort(401)
#   ...record the sale, then answer 2xx quickly.

<?php
// Verify a Nunua Pro webhook. Use the RAW request body (do not decode and re-encode it).
function verifyNunuaWebhook(string $rawBody, string $timestamp, string $signatureHeader, string $secret, int $tolerance = 300): bool
{
    // Reject old requests so a captured one cannot be replayed later.
    if (abs(time() - (int) $timestamp) > $tolerance) {
        return false;
    }
    $expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);

    return hash_equals($expected, $signatureHeader);
}

// In your endpoint:
// $ok = verifyNunuaWebhook(
//     file_get_contents('php://input'),
//     $_SERVER['HTTP_X_NUNUA_TIMESTAMP'] ?? '',
//     $_SERVER['HTTP_X_NUNUA_SIGNATURE'] ?? '',
//     getenv('NUNUA_WEBHOOK_SECRET'),
// );
// if (! $ok) { http_response_code(401); exit; }
// ...record the sale, then answer 2xx quickly.