import crypto from 'crypto';

function verifyWebhookSignature(
  payload: string,
  signatureHeader: string,
  secret: string
): boolean {
  const parts: Record<string, string> = {};
  for (const pair of signatureHeader.split(',')) {
    const [key, value] = pair.split('=');
    parts[key] = value;
  }

  const timestamp = parseInt(parts.t, 10);
  const providedSignature = parts.v1;

  // Reject if timestamp is older than 5 minutes
  if (Math.abs(Date.now() / 1000 - timestamp) > 300) {
    throw new Error('Webhook timestamp too old');
  }

  const signedPayload = `${timestamp}.${payload}`;
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(providedSignature),
    Buffer.from(expectedSignature)
  );
}

// Express.js example
app.post('/webhooks/pictify', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-pictify-signature'];
  const payload = req.body.toString();

  try {
    if (!verifyWebhookSignature(payload, signature, process.env.WEBHOOK_SECRET)) {
      return res.status(401).send('Invalid signature');
    }

    const event = JSON.parse(payload);
    console.log('Received event:', event.event);

    res.status(200).send('OK');
  } catch (error) {
    res.status(400).send(error.message);
  }
});

import hmac
import hashlib
import time

def verify_webhook_signature(payload: bytes, signature_header: str, secret: str) -> bool:
    parts = dict(pair.split('=') for pair in signature_header.split(','))
    timestamp = int(parts['t'])
    provided_signature = parts['v1']

    # Reject if timestamp is older than 5 minutes
    if abs(time.time() - timestamp) > 300:
        raise ValueError("Webhook timestamp too old")

    signed_payload = f"{timestamp}.{payload.decode()}"
    expected_signature = hmac.new(
        secret.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(provided_signature, expected_signature)

# Flask example
@app.route('/webhooks/pictify', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Pictify-Signature')
    payload = request.get_data()

    try:
        if not verify_webhook_signature(payload, signature, WEBHOOK_SECRET):
            return 'Invalid signature', 401

        event = request.get_json()
        print(f"Received event: {event['event']}")

        return 'OK', 200
    except ValueError as e:
        return str(e), 400

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "math"
    "strconv"
    "strings"
    "time"
)

func verifyWebhookSignature(payload, signatureHeader, secret string) error {
    parts := make(map[string]string)
    for _, pair := range strings.Split(signatureHeader, ",") {
        kv := strings.SplitN(pair, "=", 2)
        if len(kv) == 2 {
            parts[kv[0]] = kv[1]
        }
    }

    timestamp, _ := strconv.ParseInt(parts["t"], 10, 64)
    providedSignature := parts["v1"]

    // Reject if timestamp is older than 5 minutes
    if math.Abs(float64(time.Now().Unix()-timestamp)) > 300 {
        return fmt.Errorf("webhook timestamp too old")
    }

    signedPayload := fmt.Sprintf("%d.%s", timestamp, payload)
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(signedPayload))
    expectedSignature := hex.EncodeToString(mac.Sum(nil))

    if !hmac.Equal([]byte(providedSignature), []byte(expectedSignature)) {
        return fmt.Errorf("invalid signature")
    }

    return nil
}

require 'openssl'

def verify_webhook_signature(payload, signature_header, secret)
  parts = signature_header.split(',').map { |p| p.split('=') }.to_h
  timestamp = parts['t'].to_i
  provided_signature = parts['v1']

  # Reject if timestamp is older than 5 minutes
  if (Time.now.to_i - timestamp).abs > 300
    raise 'Webhook timestamp too old'
  end

  signed_payload = "#{timestamp}.#{payload}"
  expected_signature = OpenSSL::HMAC.hexdigest('SHA256', secret, signed_payload)

  Rack::Utils.secure_compare(provided_signature, expected_signature)
end

# Sinatra example
post '/webhooks/pictify' do
  signature = request.env['HTTP_X_PICTIFY_SIGNATURE']
  payload = request.body.read

  begin
    unless verify_webhook_signature(payload, signature, ENV['WEBHOOK_SECRET'])
      halt 401, 'Invalid signature'
    end

    event = JSON.parse(payload)
    puts "Received event: #{event['event']}"

    status 200
    'OK'
  rescue => e
    halt 400, e.message
  end
end