Receiving webhooks

use Illuminate\Http\Request;

Route::post('/tolk/webhook', function (Request $request) {
    $secret = config('services.tolk.webhook_secret');
    $timestamp = (int) $request->header('X-Tolk-Timestamp');
    $signature = (string) $request->header('X-Tolk-Signature');
    $body = $request->getContent(); // the raw body

    abort_if(abs(time() - $timestamp) > 300, 401);

    $expected = 'sha256='.hash_hmac('sha256', $timestamp.'.'.$body, $secret);
    abort_unless(hash_equals($expected, $signature), 401);

    $event = $request->json('event');
    $deliveryId = $request->header('X-Tolk-Delivery');
    // Handle the event in a job, and store $deliveryId to skip duplicate deliveries.

    return response()->noContent();
});

import express from 'express';
import { createHmac, timingSafeEqual } from 'node:crypto';

const app = express();

app.post('/tolk/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const secret = process.env.TOLK_WEBHOOK_SECRET;
  const timestamp = Number(req.get('X-Tolk-Timestamp'));
  const signature = req.get('X-Tolk-Signature') ?? '';
  const body = req.body.toString('utf8'); // the raw body

  if (!Number.isInteger(timestamp) || Math.abs(Date.now() / 1000 - timestamp) > 300) {
    return res.sendStatus(401);
  }

  const expected = 'sha256=' + createHmac('sha256', secret).update(`${timestamp}.${body}`).digest('hex');
  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  if (a.length !== b.length || !timingSafeEqual(a, b)) {
    return res.sendStatus(401);
  }

  const payload = JSON.parse(body);
  // Handle payload.event asynchronously; use req.get('X-Tolk-Delivery') to skip duplicate deliveries.
  res.sendStatus(204);
});

app.listen(3000);