Workspace Notifications

import crypto from "node:crypto";

// rawBody is the request body exactly as received, as a string.
export function verifyPhaseoSignature(rawBody, headers, secret, toleranceSeconds = 300) {
  const timestamp = headers["x-phaseo-timestamp"];
  const signature = headers["x-phaseo-signature"];
  if (!timestamp || !signature) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > toleranceSeconds) return false;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(signature, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

import hashlib
import hmac
import time

# raw_body is the request body exactly as received, as bytes.
def verify_phaseo_signature(raw_body: bytes, headers, secret: str, tolerance_seconds: int = 300) -> bool:
    timestamp = headers.get("x-phaseo-timestamp", "")
    signature = headers.get("x-phaseo-signature", "")
    if not timestamp.isdigit() or not signature:
        return False
    if abs(time.time() - int(timestamp)) > tolerance_seconds:
        return False
    expected = hmac.new(secret.encode(), timestamp.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)