事件与 Webhook

import hashlib
import hmac
import re
import time

_T = re.compile(r"[0-9]{1,12}")


def verify(raw_body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    pairs = [part.split("=", 1) for part in header.split(",") if "=" in part]
    t = next((v for k, v in pairs if k.strip() == "t"), "")
    if not _T.fullmatch(t) or abs(time.time() - int(t)) > tolerance:
        return False
    signed = t.encode("ascii") + b"." + raw_body
    expected = hmac.new(secret.encode("utf-8"), signed, hashlib.sha256).hexdigest().encode("ascii")
    return any(
        hmac.compare_digest(expected, v.strip().encode("utf-8"))
        for k, v in pairs
        if k.strip() == "v1"
    )

import crypto from 'node:crypto'

export function verify(rawBody: Buffer, header: string | undefined, secret: string, toleranceSec = 300): boolean {
  const pairs = String(header || '')
    .split(',')
    .map((part) => part.split('='))
    .filter((pair) => pair.length === 2)
  const t = (pairs.find(([k]) => k.trim() === 't') || [])[1] || ''
  if (!/^[0-9]{1,12}$/.test(t) || Math.abs(Date.now() / 1000 - Number(t)) > toleranceSec) return false
  const expected = Buffer.from(crypto.createHmac('sha256', secret).update(`${t}.`).update(rawBody).digest('hex'))
  return pairs.some(([k, v]) => {
    if (k.trim() !== 'v1') return false
    const got = Buffer.from(v.trim())
    return got.length === expected.length && crypto.timingSafeEqual(got, expected)
  })
}

function astrum_verify(string $rawBody, string $header, string $secret, int $tolerance = 300): bool
{
    $t = null;
    $signatures = [];
    foreach (explode(',', $header) as $part) {
        $kv = explode('=', trim($part), 2);
        if (count($kv) !== 2) {
            continue;
        }
        if ($kv[0] === 't') {
            $t = $kv[1];
        } elseif ($kv[0] === 'v1') {
            $signatures[] = $kv[1];
        }
    }
    if ($t === null || !preg_match('/^[0-9]{1,12}$/', $t) || abs(time() - (int) $t) > $tolerance) {
        return false;
    }
    $expected = hash_hmac('sha256', $t . '.' . $rawBody, $secret);
    foreach ($signatures as $signature) {
        if (hash_equals($expected, $signature)) {
            return true;
        }
    }
    return false;
}