Eventos, assinatura HMAC e reenvio

import crypto from 'node:crypto';

// Use o corpo CRU (Buffer/string), antes de qualquer JSON.parse
export function verifyUneway(rawBody, header, secret, toleranceSec = 300) {
  const parts = Object.fromEntries(header.split(',').map((p) => p.trim().split('=')));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSec) return false;
  const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
  const got = Buffer.from(parts.v1 || '', 'hex');
  const exp = Buffer.from(expected, 'hex');
  return got.length === exp.length && crypto.timingSafeEqual(got, exp);
}

// Express
app.post('/webhooks/uneway', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verifyUneway(req.body.toString('utf8'), req.get('X-Uneway-Signature'), process.env.UNEWAY_WEBHOOK_SECRET)) {
    return res.status(400).send('assinatura inválida');
  }
  const event = JSON.parse(req.body);
  // trate event.type de forma idempotente (event.id)
  res.sendStatus(200);
});

<?php
$raw = file_get_contents('php://input');
$header = $_SERVER['HTTP_X_UNEWAY_SIGNATURE'] ?? '';
$secret = getenv('UNEWAY_WEBHOOK_SECRET');

$parts = [];
foreach (explode(',', $header) as $piece) {
    [$k, $v] = array_pad(explode('=', trim($piece), 2), 2, '');
    $parts[$k] = $v;
}
$t = (int) ($parts['t'] ?? 0);
$expected = hash_hmac('sha256', $t . '.' . $raw, $secret);

if (!$t || abs(time() - $t) > 300 || !hash_equals($expected, $parts['v1'] ?? '')) {
    http_response_code(400);
    exit('assinatura inválida');
}

$event = json_decode($raw, true);
// trate $event['type'] de forma idempotente ($event['id'])
http_response_code(200);

# Recalcule a assinatura de um corpo salvo (body.json) para depurar
T=1759413600
SECRET=whsec_...
printf '%s.%s' "$T" "$(cat body.json)" | openssl dgst -sha256 -hmac "$SECRET"
# compare com o v1= do header X-Uneway-Signature: t=$T,v1=<hex>