import crypto from "node:crypto";

// raw = el cuerpo crudo exacto de la petición (NO hagas JSON.parse antes)
export function verify(req, secret) {
  const id  = req.headers["x-salesos-event-id"];
  const ts  = req.headers["x-salesos-timestamp"];
  const sig = req.headers["x-salesos-signature"]; // "sha256=<hex>"
  const raw = req.rawBody;

  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false; // ventana de replay

  const expected =
    "sha256=" + crypto.createHmac("sha256", secret).update(`${id}.${ts}.${raw}`).digest("hex");

  const a = Buffer.from(sig), b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

import hmac, hashlib, time

def verify(headers, raw_body: bytes, secret: str) -> bool:
    event_id = headers["X-SalesOS-Event-Id"]
    ts       = headers["X-SalesOS-Timestamp"]
    sig      = headers["X-SalesOS-Signature"]  # "sha256=<hex>"

    if abs(time.time() - int(ts)) > 300:        # ventana de replay
        return False

    msg = f"{event_id}.{ts}.{raw_body.decode()}".encode()
    expected = "sha256=" + hmac.new(secret.encode(), msg, hashlib.sha256).hexdigest()
    return hmac.compare_digest(sig, expected)