Webhooks

import hmac
import hashlib
import time
from flask import Flask, request

app = Flask(__name__)
WEBHOOK_SECRET = 'whs_4f8a1c6e90b23d75e8104a6fbc2937de'

def verify_webhook(payload, signature, timestamp, secret):
    # Check timestamp (reject if older than 5 minutes)
    if abs(time.time() - int(timestamp)) > 300:
        raise ValueError('Webhook timestamp too old')
    
    # Calculate expected signature
    signed_payload = f"{timestamp}.{payload}"
    expected_signature = hmac.new(
        secret.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()
    
    # Compare signatures
    if not hmac.compare_digest(signature, expected_signature):
        raise ValueError('Invalid webhook signature')
    
    return True

@app.route('/webhooks/bouncewatch', methods=['POST'])
def webhook_handler():
    signature = request.headers.get('X-BounceWatch-Signature')
    timestamp = request.headers.get('X-BounceWatch-Timestamp')
    payload = request.get_data(as_text=True)
    
    try:
        verify_webhook(payload, signature, timestamp, WEBHOOK_SECRET)
        event = request.get_json()
        
        # Handle the event
        print(f"Received {event['event']} event")
        
        return 'OK', 200
    except ValueError as e:
        print(f"Webhook error: {e}")
        return 'Invalid signature', 401

<?php

$webhookSecret = 'whs_4f8a1c6e90b23d75e8104a6fbc2937de';

function verifyWebhook($payload, $signature, $timestamp, $secret) {
    // Check timestamp (reject if older than 5 minutes)
    if (abs(time() - intval($timestamp)) > 300) {
        throw new Exception('Webhook timestamp too old');
    }
    
    // Calculate expected signature
    $signedPayload = "{$timestamp}.{$payload}";
    $expectedSignature = hash_hmac('sha256', $signedPayload, $secret);
    
    // Compare signatures
    if (!hash_equals($signature, $expectedSignature)) {
        throw new Exception('Invalid webhook signature');
    }
    
    return true;
}

// Get webhook data
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_BOUNCEWATCH_SIGNATURE'] ?? '';
$timestamp = $_SERVER['HTTP_X_BOUNCEWATCH_TIMESTAMP'] ?? '';

try {
    verifyWebhook($payload, $signature, $timestamp, $webhookSecret);
    $event = json_decode($payload, true);
    
    // Handle the event
    error_log("Received {$event['event']} event");
    
    http_response_code(200);
    echo 'OK';
} catch (Exception $e) {
    error_log("Webhook error: " . $e->getMessage());
    http_response_code(401);
    echo 'Invalid signature';
}