Webhooks

import express from "express"
import crypto from "node:crypto"

const app = express()
const SECRET = process.env.ELTICK_WEBHOOK_SECRET

// Importante: el cuerpo crudo, sin parsear, para verificar la firma
app.post("/webhooks/eltick", express.raw({ type: "application/json" }), (req, res) => {
  const raw = req.body.toString("utf8")
  if (!verify(raw, req.get("x-eltick-signature") ?? "", SECRET)) {
    return res.status(401).send("firma inválida")
  }
  res.sendStatus(200) // responde rápido…

  const event = JSON.parse(raw)
  queueMicrotask(() => handle(event)) // …y procesa después
})

function verify(raw, header, secret) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")))
  if (!parts.t || !parts.v1) return false
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false
  const expected = crypto.createHmac("sha256", secret).update(`${parts.t}.${raw}`).digest("hex")
  const a = Buffer.from(parts.v1, "hex")
  const b = Buffer.from(expected, "hex")
  return a.length === b.length && crypto.timingSafeEqual(a, b)
}

function handle(event) {
  if (event.test) return console.log("Evento de prueba recibido 👌")
  console.log(event.event, event.data)
}

app.listen(3000)

import hashlib, hmac, json, os, time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["ELTICK_WEBHOOK_SECRET"]

def verify(raw: bytes, header: str, secret: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    t, v1 = parts.get("t"), parts.get("v1")
    if not t or not v1 or abs(time.time() - int(t)) > 300:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

@app.post("/webhooks/eltick")
def eltick_webhook():
    raw = request.get_data()  # cuerpo crudo
    if not verify(raw, request.headers.get("X-Eltick-Signature", ""), SECRET):
        abort(401)
    event = json.loads(raw)
    if not event.get("test"):
        print(event["event"], event["data"])
    return "", 200

<?php
$secret = getenv("ELTICK_WEBHOOK_SECRET");
$raw = file_get_contents("php://input"); // cuerpo crudo
$header = $_SERVER["HTTP_X_ELTICK_SIGNATURE"] ?? "";

parse_str(str_replace(",", "&", $header), $parts);
$t = $parts["t"] ?? "";
$v1 = $parts["v1"] ?? "";
$expected = hash_hmac("sha256", "$t.$raw", $secret);

if (!$t || abs(time() - (int) $t) > 300 || !hash_equals($expected, $v1)) {
  http_response_code(401);
  exit("firma inválida");
}

http_response_code(200);
$event = json_decode($raw, true);
if (empty($event["test"])) {
  error_log($event["event"] . " " . json_encode($event["data"]));
}