import express from "express";
import { createHmac, timingSafeEqual } from "crypto";

const app = express();

// CRITICAL: raw body parser BEFORE any json() middleware
app.use("/webhooks/cardzero", express.raw({ type: "application/json" }));

app.post("/webhooks/cardzero", (req, res) => {
  const rawBody = (req.body as Buffer).toString("utf8");
  const sigHeader = req.headers["x-cardzero-signature"] as string;

  if (!verify(rawBody, sigHeader, process.env.WEBHOOK_SECRET!)) {
    return res.status(401).send("invalid signature");
  }

  const event = JSON.parse(rawBody);
  console.log("Got CardZero event:", event.type, event.jobId);
  // ... process event ...
  res.status(200).send("ok");
});

function verify(body: string, header: string, secret: string): boolean {
  const expected = createHmac("sha256", secret).update(body).digest("hex");
  const received = header.replace(/^sha256=/, "");
  if (expected.length !== received.length) return false;
  return timingSafeEqual(Buffer.from(expected), Buffer.from(received));
}

// app/api/webhooks/cardzero/route.ts
import { createHmac, timingSafeEqual } from "crypto";

export async function POST(req: Request) {
  const rawBody = await req.text();
  const sigHeader = req.headers.get("x-cardzero-signature") || "";

  if (!verify(rawBody, sigHeader, process.env.WEBHOOK_SECRET!)) {
    return new Response("invalid signature", { status: 401 });
  }

  const event = JSON.parse(rawBody);
  // ... process ...
  return new Response("ok", { status: 200 });
}

function verify(body: string, header: string, secret: string): boolean {
  const expected = createHmac("sha256", secret).update(body).digest("hex");
  const received = header.replace(/^sha256=/, "");
  if (expected.length !== received.length) return false;
  return timingSafeEqual(Buffer.from(expected), Buffer.from(received));
}

import hmac
import hashlib
from flask import Flask, request

app = Flask(__name__)
WEBHOOK_SECRET = os.environ["CARDZERO_WEBHOOK_SECRET"]

@app.route("/webhooks/cardzero", methods=["POST"])
def webhook():
    raw_body = request.get_data()  # bytes
    signature = request.headers.get("X-CardZero-Signature", "")

    expected = hmac.new(
        WEBHOOK_SECRET.encode(),
        raw_body,
        hashlib.sha256
    ).hexdigest()

    received = signature.replace("sha256=", "", 1)
    if not hmac.compare_digest(expected, received):
        return "invalid signature", 401

    event = json.loads(raw_body)
    # ... process ...
    return "ok", 200

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "io"
    "net/http"
    "os"
    "strings"
)

var secret = os.Getenv("CARDZERO_WEBHOOK_SECRET")

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    rawBody, _ := io.ReadAll(r.Body)

    sigHeader := r.Header.Get("X-CardZero-Signature")
    received := strings.TrimPrefix(sigHeader, "sha256=")

    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write(rawBody)
    expected := hex.EncodeToString(mac.Sum(nil))

    if !hmac.Equal([]byte(expected), []byte(received)) {
        http.Error(w, "invalid signature", 401)
        return
    }

    // ... process rawBody as JSON ...
    w.WriteHeader(http.StatusOK)
}

require 'openssl'

class WebhooksController < ApplicationController
  skip_before_action :verify_authenticity_token

  def cardzero
    raw_body = request.raw_post
    sig_header = request.headers['X-CardZero-Signature']

    expected = OpenSSL::HMAC.hexdigest('SHA256', ENV['WEBHOOK_SECRET'], raw_body)
    received = sig_header.sub('sha256=', '')

    unless ActiveSupport::SecurityUtils.secure_compare(expected, received)
      render plain: 'invalid signature', status: 401
      return
    end

    event = JSON.parse(raw_body)
    # ... process ...
    head :ok
  end
end