const crypto = require("crypto");

function verifyWebhookSignature(rawBody, signature, secret) {
  const expectedSig = crypto
    .createHmac("sha256", secret)
    .update(rawBody, "utf8")
    .digest("hex");

  const receivedSig = signature.replace("sha256=", "");

  return crypto.timingSafeEqual(
    Buffer.from(expectedSig, "hex"),
    Buffer.from(receivedSig, "hex")
  );
}

// Express middleware
app.post("/webhooks/zenoo", (req, res) => {
  const signature = req.headers["x-zenoo-signature"];
  const isValid = verifyWebhookSignature(
    req.rawBody,
    signature,
    process.env.ZENOO_WEBHOOK_SECRET
  );

  if (!isValid) {
    return res.status(401).json({ error: "Invalid signature" });
  }

  // Process the webhook
  res.status(200).json({ received: true });
});

import hmac
import hashlib

def verify_webhook_signature(raw_body: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode('utf-8'),
        raw_body,
        hashlib.sha256
    ).hexdigest()

    received = signature.replace('sha256=', '')
    return hmac.compare_digest(expected, received)

# Flask route
@app.route('/webhooks/zenoo', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Zenoo-Signature', '')
    is_valid = verify_webhook_signature(
        request.get_data(),
        signature,
        os.environ['ZENOO_WEBHOOK_SECRET']
    )

    if not is_valid:
        return jsonify({'error': 'Invalid signature'}), 401

    # Process the webhook
    return jsonify({'received': True}), 200

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;

public class WebhookVerifier {
    public static boolean verify(String rawBody, String signature, String secret)
            throws Exception {
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secret.getBytes("UTF-8"), "HmacSHA256"));
        byte[] hash = mac.doFinal(rawBody.getBytes("UTF-8"));

        String expected = bytesToHex(hash);
        String received = signature.replace("sha256=", "");

        return MessageDigest.isEqual(
            expected.getBytes("UTF-8"),
            received.getBytes("UTF-8")
        );
    }

    private static String bytesToHex(byte[] bytes) {
        StringBuilder sb = new StringBuilder();
        for (byte b : bytes) {
            sb.append(String.format("%02x", b));
        }
        return sb.toString();
    }
}