import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyRewriteWebhook({
  svixId,
  svixTimestamp,
  svixSignature,
  payload,
  secret,
}: {
  svixId?: string;
  svixTimestamp?: string;
  svixSignature?: string;
  payload: string;
  secret: string;
}) {
  if (!secret) {
    throw new Error('Rewrite webhook secret is missing.');
  }

  const value = secret.startsWith('whsec_')
    ? secret.slice('whsec_'.length)
    : secret;

  const key = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}(?:==)?|[A-Za-z0-9+/]{3}=?)?$/.test(
    value,
  )
    ? Buffer.from(value, 'base64')
    : null;

  const signature = svixSignature?.split(',')[1];

  if (!key || !svixId || !svixTimestamp || !signature) {
    return false;
  }

  const expected = createHmac('sha256', key)
    .update(`${svixId}.${svixTimestamp}.${payload}`)
    .digest('base64');

  return (
    signature.length === expected.length &&
    timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
  );
}

package webhook

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"
	"errors"
	"strings"
)

func VerifyRewriteWebhook(
	svixID string,
	svixTimestamp string,
	svixSignature string,
	payload string,
	secret string,
) (bool, error) {
	if secret == "" {
		return false, errors.New("rewrite webhook secret is missing")
	}

	value := strings.TrimPrefix(secret, "whsec_")

	key, err := base64.StdEncoding.DecodeString(value)
	if err != nil {
		return false, nil
	}

	parts := strings.Split(svixSignature, ",")
	if svixID == "" || svixTimestamp == "" || len(parts) < 2 {
		return false, nil
	}

	signature := parts[1]

	mac := hmac.New(sha256.New, key)
	mac.Write([]byte(svixID + "." + svixTimestamp + "." + payload))

	expected := base64.StdEncoding.EncodeToString(mac.Sum(nil))

	return hmac.Equal([]byte(signature), []byte(expected)), nil
}

import base64
import hashlib
import hmac


def verify_rewrite_webhook(
    *,
    svix_id: str | None,
    svix_timestamp: str | None,
    svix_signature: str | None,
    payload: str,
    secret: str,
) -> bool:
    if not secret:
        raise ValueError("Rewrite webhook secret is missing.")

    value = secret.removeprefix("whsec_")

    try:
        key = base64.b64decode(value, validate=True)
    except Exception:
        return False

    parts = svix_signature.split(",") if svix_signature else []
    signature = parts[1] if len(parts) > 1 else None

    if not key or not svix_id or not svix_timestamp or not signature:
        return False

    signed = f"{svix_id}.{svix_timestamp}.{payload}".encode("utf-8")
    expected = base64.b64encode(
        hmac.new(key, signed, hashlib.sha256).digest()
    ).decode("utf-8")

    return hmac.compare_digest(signature, expected)