Documentación API para developers

import crypto from "node:crypto";

// rawBody: the request body exactly as received (a Buffer or string).
function verifyNexulexWebhook(rawBody, headers, secret) {
  const ts = headers["nexulex-webhook-timestamp"] || "";
  const sig = headers["nexulex-webhook-signature"] || "";
  if (!/^\d+$/.test(ts) || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const expected = "v1=" + crypto.createHmac("sha256", secret)
    .update(ts + ".").update(rawBody).digest("hex");
  return sig.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
}

import hashlib
import hmac
import time

# raw_body: the request body exactly as received (bytes), before parsing.
def verify_nexulex_webhook(raw_body: bytes, headers, secret: str) -> bool:
    ts = headers.get("Nexulex-Webhook-Timestamp", "")
    sig = headers.get("Nexulex-Webhook-Signature", "")
    if not ts.isdigit() or abs(time.time() - int(ts)) > 300:
        return False
    mac = hmac.new(secret.encode(), ts.encode() + b"." + raw_body, hashlib.sha256)
    return hmac.compare_digest(sig, "v1=" + mac.hexdigest())

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"net/http"
	"strconv"
	"time"
)

// rawBody: the request body exactly as received (read it before decoding).
func verifyNexulexWebhook(rawBody []byte, h http.Header, secret string) bool {
	ts := h.Get("Nexulex-Webhook-Timestamp")
	sec, err := strconv.ParseInt(ts, 10, 64)
	if err != nil || time.Since(time.Unix(sec, 0)).Abs() > 5*time.Minute {
		return false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(ts + "."))
	mac.Write(rawBody)
	expected := "v1=" + hex.EncodeToString(mac.Sum(nil))
	return hmac.Equal([]byte(h.Get("Nexulex-Webhook-Signature")), []byte(expected))
}

<?php
// $rawBody: file_get_contents('php://input'), before any json_decode.
function verifyNexulexWebhook(string $rawBody, string $secret): bool
{
    $ts = $_SERVER['HTTP_NEXULEX_WEBHOOK_TIMESTAMP'] ?? '';
    $sig = $_SERVER['HTTP_NEXULEX_WEBHOOK_SIGNATURE'] ?? '';
    if (!ctype_digit($ts) || abs(time() - (int) $ts) > 300) {
        return false;
    }
    $expected = 'v1=' . hash_hmac('sha256', $ts . '.' . $rawBody, $secret);
    return hash_equals($expected, $sig);
}

require "openssl"

# raw_body: request.raw_post (Rails) or request.body.read, before parsing.
def verify_nexulex_webhook(raw_body, headers, secret)
  ts = headers["Nexulex-Webhook-Timestamp"].to_s
  sig = headers["Nexulex-Webhook-Signature"].to_s
  return false unless ts.match?(/\A\d+\z/) && (Time.now.to_i - ts.to_i).abs <= 300

  expected = "v1=" + OpenSSL::HMAC.hexdigest("SHA256", secret, "#{ts}.#{raw_body}")
  # Constant-time compare that works on every Ruby (Rails: ActiveSupport::SecurityUtils.secure_compare).
  return false unless expected.bytesize == sig.bytesize

  expected.bytes.zip(sig.bytes).reduce(0) { |acc, (a, b)| acc | (a ^ b) }.zero?
end

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.HexFormat;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

// rawBody: the request body exactly as received, before parsing.
// ts / sig: the Nexulex-Webhook-Timestamp / -Signature headers.
static boolean verifyNexulexWebhook(byte[] rawBody, String ts, String sig, String secret)
        throws Exception {
    long sec;
    try {
        sec = Long.parseLong(ts);
    } catch (NumberFormatException e) {
        return false;
    }
    if (Math.abs(System.currentTimeMillis() / 1000 - sec) > 300) return false;
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
    mac.update((ts + ".").getBytes(StandardCharsets.UTF_8));
    String expected = "v1=" + HexFormat.of().formatHex(mac.doFinal(rawBody));
    return MessageDigest.isEqual(expected.getBytes(StandardCharsets.UTF_8),
        (sig == null ? "" : sig).getBytes(StandardCharsets.UTF_8));
}

using System.Linq;
using System.Security.Cryptography;
using System.Text;

// rawBody: the request body exactly as received, before parsing.
// ts / sig: the Nexulex-Webhook-Timestamp / -Signature headers.
static bool VerifyNexulexWebhook(byte[] rawBody, string? ts, string? sig, string secret)
{
    if (!long.TryParse(ts, out var sec) ||
        Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - sec) > 300)
        return false;
    var signed = Encoding.UTF8.GetBytes(ts + ".").Concat(rawBody).ToArray();
    var hash = HMACSHA256.HashData(Encoding.UTF8.GetBytes(secret), signed);
    var expected = "v1=" + Convert.ToHexString(hash).ToLowerInvariant();
    return CryptographicOperations.FixedTimeEquals(
        Encoding.UTF8.GetBytes(expected), Encoding.UTF8.GetBytes(sig ?? ""));
}