import crypto from "node:crypto";
import express from "express";

const app = express();
const secret = process.env.FREQUENTIX_WEBHOOK_SECRET; // whsec_…

// express.raw keeps the body as the exact bytes that were signed —
// re-serialising parsed JSON would break the signature.
app.post(
  "/webhooks/frequentix",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const header = req.header("X-Frequentix-Signature") ?? "";
    const parts = Object.fromEntries(
      header.split(",").map((pair) => pair.split("=", 2)),
    );
    const timestamp = Number(parts.t);
    const expected = String(parts.v1 ?? "");

    // Each attempt is signed freshly, so a 5-minute tolerance blocks replays.
    if (!Number.isFinite(timestamp) || Math.abs(Date.now() / 1000 - timestamp) > 300) {
      return res.status(400).send("Stale signature");
    }

    const digest = crypto
      .createHmac("sha256", secret)
      .update(`${timestamp}.`)
      .update(req.body) // Buffer of the raw body
      .digest("hex");

    const valid =
      expected.length === digest.length &&
      crypto.timingSafeEqual(Buffer.from(digest), Buffer.from(expected));

    if (!valid) return res.status(400).send("Invalid signature");

    const event = JSON.parse(req.body.toString("utf8"));
    const deliveryId = req.header("X-Frequentix-Delivery"); // stable across retries

    res.status(204).end(); // acknowledge fast…
    handleAsync(event, deliveryId); // …then do the real work asynchronously
  },
);

<?php

$secret = getenv('FREQUENTIX_WEBHOOK_SECRET'); // whsec_…

// php://input is the raw body exactly as signed — never re-encode parsed JSON.
$body = file_get_contents('php://input');
// The X-Frequentix-Signature header, as PHP surfaces it.
$header = $_SERVER['HTTP_X_FREQUENTIX_SIGNATURE'] ?? '';

parse_str(str_replace(',', '&', $header), $parts);
$timestamp = (int) ($parts['t'] ?? 0);
$expected = (string) ($parts['v1'] ?? '');

// Each attempt is signed freshly, so a 5-minute tolerance blocks replays.
if (abs(time() - $timestamp) > 300) {
    http_response_code(400);
    exit;
}

$digest = hash_hmac('sha256', $timestamp.'.'.$body, $secret);

if (! hash_equals($digest, $expected)) {
    http_response_code(400);
    exit;
}

$event = json_decode($body, true);
// X-Frequentix-Delivery is stable across retries — your dedupe key.
$deliveryId = $_SERVER['HTTP_X_FREQUENTIX_DELIVERY'] ?? null;

http_response_code(204); // acknowledge fast, then queue the real work

import hashlib
import hmac
import json
import os
import time

from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ["FREQUENTIX_WEBHOOK_SECRET"].encode()  # whsec_…


@app.post("/webhooks/frequentix")
def frequentix_webhook():
    # get_data() is the raw body exactly as signed — never re-encode parsed JSON.
    body = request.get_data()
    header = request.headers.get("X-Frequentix-Signature", "")
    parts = dict(pair.split("=", 1) for pair in header.split(",") if "=" in pair)
    timestamp = int(parts.get("t", "0"))
    expected = parts.get("v1", "")

    # Each attempt is signed freshly, so a 5-minute tolerance blocks replays.
    if abs(time.time() - timestamp) > 300:
        return "Stale signature", 400

    digest = hmac.new(SECRET, f"{timestamp}.".encode() + body, hashlib.sha256)

    if not hmac.compare_digest(digest.hexdigest(), expected):
        return "Invalid signature", 400

    event = json.loads(body)
    delivery_id = request.headers.get("X-Frequentix-Delivery")  # stable across retries

    handle_async(event, delivery_id)  # acknowledge fast, work asynchronously
    return "", 204

require "json"
require "openssl"
require "sinatra"

SECRET = ENV.fetch("FREQUENTIX_WEBHOOK_SECRET") # whsec_…

post "/webhooks/frequentix" do
  # request.body is the raw body exactly as signed — never re-encode parsed JSON.
  body = request.body.read
  # The X-Frequentix-Signature header, as Rack surfaces it.
  header = request.env["HTTP_X_FREQUENTIX_SIGNATURE"].to_s
  parts = header.split(",").to_h { |pair| pair.split("=", 2) }
  timestamp = parts["t"].to_i
  expected = parts["v1"].to_s

  # Each attempt is signed freshly, so a 5-minute tolerance blocks replays.
  halt 400, "Stale signature" if (Time.now.to_i - timestamp).abs > 300

  digest = OpenSSL::HMAC.hexdigest("SHA256", SECRET, "#{timestamp}.#{body}")

  unless expected.bytesize == digest.bytesize &&
         OpenSSL.fixed_length_secure_compare(digest, expected)
    halt 400, "Invalid signature"
  end

  event = JSON.parse(body)
  # X-Frequentix-Delivery is stable across retries — your dedupe key.
  delivery_id = request.env["HTTP_X_FREQUENTIX_DELIVERY"]

  status 204 # acknowledge fast, then queue the real work
end