const express = require('express');
const crypto = require('crypto');
const app = express();

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const secretKey = 'sec_kunci_rahasia_proyek_anda';
  const signature = req.headers['x-yobase-signature'];
  const timestamp = req.headers['x-yobase-timestamp'];
  const rawBody   = req.body.toString('utf8');

  if (Math.abs(Math.floor(Date.now() / 1000) - parseInt(timestamp)) > 300) {
    return res.status(401).send('Expired timestamp');
  }

  const bodyHash     = crypto.createHash('sha256').update(rawBody).digest('hex');
  const stringToSign = `POST:${req.originalUrl}:${timestamp}:${bodyHash}`;
  const expected     = crypto.createHmac('sha256', secretKey).update(stringToSign).digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).send('Invalid signature');
  }

  const payload = JSON.parse(rawBody);
  res.status(200).send('OK');
});

import hmac, hashlib, time, json
from flask import Flask, request, abort

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def handle_webhook():
    secret_key = b"sec_kunci_rahasia_proyek_anda"
    signature = request.headers.get("X-Yobase-Signature", "")
    timestamp = request.headers.get("X-Yobase-Timestamp", "")
    raw_body = request.get_data()

    if abs(int(time.time()) - int(timestamp)) > 300:
        abort(401, "Expired timestamp")

    body_hash = hashlib.sha256(raw_body).hexdigest().lower()
    string_to_sign = f"POST:{request.path}:{timestamp}:{body_hash}"
    expected = hmac.new(secret_key, string_to_sign.encode('utf-8'), hashlib.sha256).hexdigest()

    if not hmac.compare_digest(expected, signature):
        abort(401, "Invalid signature")

    payload = json.loads(raw_body)
    return "OK", 200

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"math"
	"net/http"
	"strconv"
	"strings"
	"time"
)

func webhookHandler(w http.ResponseWriter, r *http.Request) {
	secretKey := "sec_kunci_rahasia_proyek_anda"
	signature := r.Header.Get("X-Yobase-Signature")
	timestampStr := r.Header.Get("X-Yobase-Timestamp")
	body, _ := io.ReadAll(r.Body)

	ts, _ := strconv.ParseInt(timestampStr, 10, 64)
	if math.Abs(float64(time.Now().Unix()-ts)) > 300 {
		http.Error(w, "Expired timestamp", http.StatusUnauthorized)
		return
	}

	bodyHash := sha256.Sum256(body)
	bodyHashHex := strings.ToLower(hex.EncodeToString(bodyHash[:]))
	stringToSign := "POST:" + r.URL.Path + ":" + timestampStr + ":" + bodyHashHex

	mac := hmac.New(sha256.New, []byte(secretKey))
	mac.Write([]byte(stringToSign))
	expected := hex.EncodeToString(mac.Sum(nil))

	if !hmac.Equal([]byte(expected), []byte(signature)) {
		http.Error(w, "Invalid signature", http.StatusUnauthorized)
		return
	}

	w.WriteHeader(http.StatusOK)
	w.Write([]byte("OK"))
}