Webhook Auth

const crypto = require('crypto')

// Express — use raw body para validação
app.post('/webhook/auth', express.raw({ type: 'application/json' }), (req, res) => {
  const body = req.body.toString('utf8')
  const esperado = 'sha256=' + crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(body)
    .digest('hex')

  if (!crypto.timingSafeEqual(
    Buffer.from(req.headers['x-campeao-signature']),
    Buffer.from(esperado)
  )) {
    return res.status(401).send('Assinatura inválida')
  }

  const evento = JSON.parse(body)
  const { auth_id, external_id, authenticated, score_facial } = evento

  if (authenticated) {
    // Liberar operação sensível para o usuário
    await liberarOperacao(external_id, auth_id)
  }

  res.status(200).send('OK')
})

import hashlib, hmac, json
from fastapi import Request, HTTPException

async def validar_auth_webhook(request: Request, secret: str) -> dict:
    body = await request.body()
    assinatura = request.headers.get('x-campeao-signature', '')

    esperado = 'sha256=' + hmac.new(
        secret.encode('utf-8'),
        body,
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(assinatura, esperado):
        raise HTTPException(status_code=401, detail='Assinatura inválida')

    return json.loads(body)

@app.post('/webhook/auth')
async def webhook_auth(request: Request):
    evento = await validar_auth_webhook(request, os.environ['WEBHOOK_SECRET'])

    if evento['authenticated']:
        await liberar_operacao(evento['external_id'], evento['auth_id'])

    return {'ok': True}

$payload    = file_get_contents('php://input');
$assinatura = $_SERVER['HTTP_X_CAMPEAO_SIGNATURE'] ?? '';
$secret     = getenv('WEBHOOK_SECRET');

$esperado = 'sha256=' . hash_hmac('sha256', $payload, $secret);
if (!hash_equals($esperado, $assinatura)) {
    http_response_code(401);
    exit('Assinatura inválida');
}

$evento = json_decode($payload, true);
if ($evento['authenticated']) {
    liberarOperacao($evento['external_id'], $evento['auth_id']);
}

http_response_code(200);
echo 'OK';