import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyPrismWebhook(headers, rawBody, secret) {
  const id = headers["webhook-id"];
  const ts = headers["webhook-timestamp"];
  const sigHeader = headers["webhook-signature"] ?? "";

  // Bound replay first — a valid signature on a six-month-old body is still a replay.
  if (!ts || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;

  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = createHmac("sha256", key)
    .update(`${id}.${ts}.${rawBody}`)
    .digest("base64");

  // The header may carry several space-separated signatures during secret rotation.
  return sigHeader.split(" ").some((part) => {
    if (!part.startsWith("v1,")) return false;
    const got = Buffer.from(part.slice(3), "utf8");
    const want = Buffer.from(expected, "utf8");
    return got.length === want.length && timingSafeEqual(got, want);
  });
}

import base64, hmac, hashlib, time

def verify_prism_webhook(headers, raw_body: bytes, secret: str) -> bool:
    wid = headers.get("webhook-id", "")
    ts = headers.get("webhook-timestamp", "")
    sig_header = headers.get("webhook-signature", "")

    try:
        if abs(time.time() - int(ts)) > 300:
            return False
    except ValueError:
        return False

    key = base64.b64decode(secret.removeprefix("whsec_"))
    message = f"{wid}.{ts}.".encode() + raw_body
    expected = base64.b64encode(hmac.new(key, message, hashlib.sha256).digest()).decode()

    for part in sig_header.split(" "):
        if part.startswith("v1,") and hmac.compare_digest(part[3:], expected):
            return True
    return False

package prism

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
	"math"
	"net/http"
	"strconv"
	"strings"
	"time"
)

func Verify(h http.Header, rawBody []byte, secret string) bool {
	id := h.Get("webhook-id")
	ts := h.Get("webhook-timestamp")

	sec, err := strconv.ParseInt(ts, 10, 64)
	if err != nil || math.Abs(float64(time.Now().Unix()-sec)) > 300 {
		return false
	}

	key, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(secret, "whsec_"))
	if err != nil {
		return false
	}
	mac := hmac.New(sha256.New, key)
	mac.Write([]byte(id + "." + ts + "."))
	mac.Write(rawBody)
	expected := base64.StdEncoding.EncodeToString(mac.Sum(nil))

	for _, part := range strings.Split(h.Get("webhook-signature"), " ") {
		if strings.HasPrefix(part, "v1,") && hmac.Equal([]byte(part[3:]), []byte(expected)) {
			return true
		}
	}
	return false
}