import crypto from 'node:crypto';
import express from 'express';

const app = express();

// IMPORTANT: read the raw body so the HMAC matches.
app.use('/webhooks', express.raw({ type: 'application/json' }));

function verifyWebhook(req, webhookSecret) {
  const headerHmac = req.headers['x-lms-hmac-sha256'];
  if (!headerHmac) return false;

  const computed = crypto
    .createHmac('sha256', webhookSecret)
    .update(req.body) // req.body is a Buffer because of express.raw
    .digest('base64');

  // Buffers of different length crash timingSafeEqual — guard first.
  const a = Buffer.from(headerHmac, 'utf8');
  const b = Buffer.from(computed, 'utf8');
  if (a.length !== b.length) return false;
  return crypto.timingSafeEqual(a, b);
}

app.post('/webhooks', (req, res) => {
  if (!verifyWebhook(req, process.env.WEBHOOK_SECRET)) {
    console.warn('[webhook] invalid signature');
    return res.status(401).send('Unauthorized');
  }

  const topic = req.headers['x-lms-topic'];
  const payload = JSON.parse(req.body.toString('utf8'));
  console.log(`[webhook] ${topic} for shop ${req.headers['x-lms-shop-domain']}`);

  // Always respond 200 quickly. Heavy work goes to a queue.
  res.status(200).send('OK');
});

import hmac, hashlib, base64
from flask import Flask, request

app = Flask(__name__)
WEBHOOK_SECRET = os.environ['WEBHOOK_SECRET']

def verify_webhook(req) -> bool:
    header_hmac = req.headers.get('X-LMS-Hmac-SHA256')
    if not header_hmac:
        return False

    # request.get_data() returns the raw bytes — must call this BEFORE
    # any access to request.get_json(), which consumes the stream.
    body = req.get_data()
    computed = base64.b64encode(
        hmac.new(WEBHOOK_SECRET.encode(), body, hashlib.sha256).digest()
    ).decode()

    return hmac.compare_digest(header_hmac, computed)

@app.route('/webhooks', methods=['POST'])
def webhooks():
    if not verify_webhook(request):
        return 'Unauthorized', 401
    topic = request.headers.get('X-LMS-Topic')
    payload = request.get_json()  # safe — raw body already read
    print(f'[webhook] {topic}')
    return 'OK', 200

require 'openssl'
require 'base64'
require 'rack/utils'
require 'sinatra'

WEBHOOK_SECRET = ENV['WEBHOOK_SECRET']

def verify_webhook(body, header_hmac)
  return false if header_hmac.nil?
  computed = Base64.strict_encode64(
    OpenSSL::HMAC.digest('sha256', WEBHOOK_SECRET, body)
  )
  Rack::Utils.secure_compare(header_hmac, computed)
end

post '/webhooks' do
  request.body.rewind
  body = request.body.read
  header_hmac = request.env['HTTP_X_LMS_HMAC_SHA256']
  halt 401, 'Unauthorized' unless verify_webhook(body, header_hmac)

  topic = request.env['HTTP_X_LMS_TOPIC']
  payload = JSON.parse(body)
  puts "[webhook] #{topic}"
  status 200
  'OK'
end

<?php
$webhookSecret = getenv('WEBHOOK_SECRET');

// Must read php://input BEFORE any framework parsing.
$body = file_get_contents('php://input');
$headerHmac = $_SERVER['HTTP_X_LMS_HMAC_SHA256'] ?? null;

function verifyWebhook(string $body, ?string $headerHmac, string $secret): bool {
    if ($headerHmac === null) return false;
    $computed = base64_encode(hash_hmac('sha256', $body, $secret, true));
    return hash_equals($headerHmac, $computed);
}

if (!verifyWebhook($body, $headerHmac, $webhookSecret)) {
    http_response_code(401);
    echo 'Unauthorized';
    exit;
}

$payload = json_decode($body, true);
$topic = $_SERVER['HTTP_X_LMS_TOPIC'] ?? '';
error_log("[webhook] $topic");
http_response_code(200);
echo 'OK';

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "io"
    "net/http"
    "os"
)

var webhookSecret = os.Getenv("WEBHOOK_SECRET")

func verifyWebhook(body []byte, headerHmac string) bool {
    if headerHmac == "" {
        return false
    }
    mac := hmac.New(sha256.New, []byte(webhookSecret))
    mac.Write(body)
    computed := base64.StdEncoding.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(headerHmac), []byte(computed))
}

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    body, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "bad request", http.StatusBadRequest)
        return
    }
    headerHmac := r.Header.Get("X-LMS-Hmac-SHA256")
    if !verifyWebhook(body, headerHmac) {
        http.Error(w, "Unauthorized", http.StatusUnauthorized)
        return
    }
    // process payload, return 200 quickly...
    w.WriteHeader(http.StatusOK)
    w.Write([]byte("OK"))
}