Webhooks

import { createHmac, timingSafeEqual } from 'node:crypto';

const TOLERANCE_SECONDS = 300;

export function isValidArara(rawBody, headers, secret) {
  const timestamp = headers['x-arara-timestamp'];
  const signature = headers['x-arara-signature'];
  if (typeof timestamp !== 'string' || typeof signature !== 'string') return false;
  if (!/^\d+$/.test(timestamp) || !signature.startsWith('sha256=')) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > TOLERANCE_SECONDS) return false;

  const expected = createHmac('sha256', secret)
    .update(`${timestamp}.`)
    .update(rawBody)
    .digest('hex');
  const a = Buffer.from(expected);
  const b = Buffer.from(signature.slice('sha256='.length));
  return a.length === b.length && timingSafeEqual(a, b);
}

import hashlib
import hmac
import time

TOLERANCE_SECONDS = 300

def is_valid_arara(raw_body: bytes, headers: dict, secret: str) -> bool:
    timestamp = headers.get("X-Arara-Timestamp")
    signature = headers.get("X-Arara-Signature")
    if not isinstance(timestamp, str) or not isinstance(signature, str):
        return False
    if not timestamp.isdigit() or not signature.startswith("sha256="):
        return False
    if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        return False
    expected = hmac.new(
        secret.encode(), timestamp.encode() + b"." + raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature[len("sha256="):])

<?php

const TOLERANCE_SECONDS = 300;

function isValidArara(string $rawBody, array $headers, string $secret): bool
{
    $timestamp = $headers['X-Arara-Timestamp'] ?? '';
    $signature = $headers['X-Arara-Signature'] ?? '';
    if (!is_string($timestamp) || !is_string($signature)) {
        return false;
    }
    if (!ctype_digit($timestamp) || !str_starts_with($signature, 'sha256=')) {
        return false;
    }
    if (abs(time() - (int) $timestamp) > TOLERANCE_SECONDS) {
        return false;
    }
    $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    return hash_equals($expected, substr($signature, strlen('sha256=')));
}