Webhookuri și evenimente

{
  "id": "evt_10422",
  "object": "event",
  "type": "efactura.accepted",
  "company_id": 7,
  "created_at": "2026-10-09T14:09:40+03:00",
  "data": {
    "object": {
      "id": 812, "object": "document", "type": "invoice", "status": "issued", "number": "FCT 42",
      "external_ref": "comanda-1042",
      "efactura": { "applies": true, "status": "accepted", "upload_index": "5012345678", "errors": null, "scheduled_at": null, "anaf_id": null },
      "…": "…"
    }
  }
}

import crypto from 'node:crypto';

export function verify(secret, headers, body) {
  const id = headers['webhook-id'], ts = headers['webhook-timestamp'], sigs = headers['webhook-signature'];
  if (!id || !ts || !sigs || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const key = Buffer.from(secret.slice('whsec_'.length), 'base64');
  const expected = crypto.createHmac('sha256', key).update(`${id}.${ts}.${body}`).digest();
  return sigs.split(' ').some((s) => {
    const [v, b64] = s.split(',');
    const got = Buffer.from(b64 || '', 'base64');
    return v === 'v1' && got.length === expected.length && crypto.timingSafeEqual(got, expected);
  });
}

// Express: corpul brut, nu cel parsat
app.post('/webhooks/chappa', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verify(process.env.CHAPPA_WHSEC, req.headers, req.body)) return res.sendStatus(400);
  res.sendStatus(200);
  queue.push(JSON.parse(req.body));
});

import base64, hashlib, hmac, time

def verify(secret: str, headers, body: bytes) -> bool:
    msg_id, ts, sigs = headers.get("webhook-id"), headers.get("webhook-timestamp"), headers.get("webhook-signature")
    if not (msg_id and ts and sigs) or abs(time.time() - int(ts)) > 300:
        return False
    key = base64.b64decode(secret.removeprefix("whsec_"))
    mac = hmac.new(key, f"{msg_id}.{ts}.".encode() + body, hashlib.sha256).digest()
    expected = base64.b64encode(mac).decode()
    return any(hmac.compare_digest(s[3:], expected) for s in sigs.split(" ") if s.startswith("v1,"))

function verify(string $secret, array $h, string $body): bool {
    $id = $h['webhook-id'] ?? ''; $ts = $h['webhook-timestamp'] ?? ''; $sigs = $h['webhook-signature'] ?? '';
    if ($id === '' || $ts === '' || abs(time() - (int) $ts) > 300) return false;
    $key = base64_decode(substr($secret, strlen('whsec_')));
    $expected = base64_encode(hash_hmac('sha256', "$id.$ts.$body", $key, true));
    foreach (explode(' ', $sigs) as $s) {
        if (str_starts_with($s, 'v1,') && hash_equals($expected, substr($s, 3))) return true;
    }
    return false;
}

$ok = verify(getenv('CHAPPA_WHSEC'), array_change_key_case(getallheaders()), file_get_contents('php://input'));