Webhook integration & verification

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "errors"
    "strings"

    "github.com/decred/dcrd/dcrec/secp256k1/v4"
    "github.com/decred/dcrd/dcrec/secp256k1/v4/ecdsa"
)

type payload struct {
    CanonicalString  string `json:"canonical_string"`
    CanonicalMessage struct {
        Threshold int   `json:"threshold"`
        ExpiresAt int64 `json:"expires_at"`
    } `json:"canonical_message"`
    Signatures []struct {
        Pubkey    string `json:"pubkey"`
        Signature string `json:"signature"`
    } `json:"signatures"`
}

// Verify returns nil if the webhook is authentic and has enough valid approvals.
// whitelist = the set of your team's known member public keys (lowercase 0x-hex).
func Verify(rawBody []byte, xSig, xTs, hmacSecret string, whitelist map[string]bool) error {
    // 1. Envelope: HMAC-SHA256(secret, timestamp + "." + rawBody)
    mac := hmac.New(sha256.New, []byte(hmacSecret))
    mac.Write([]byte(xTs + "." + string(rawBody)))
    if !hmac.Equal([]byte(hex.EncodeToString(mac.Sum(nil))), []byte(xSig)) {
        return errors.New("bad HMAC signature")
    }
    // (also reject if xTs is more than a few minutes from your clock)

    var p payload
    if err := json.Unmarshal(rawBody, &p); err != nil {
        return err
    }

    // 2. The signed digest is SHA-256 of the canonical string.
    digest := sha256.Sum256([]byte(p.CanonicalString))

    // 3. Verify each signature against a whitelisted key; count distinct valid.
    seen, valid := map[string]bool{}, 0
    for _, s := range p.Signatures {
        k := strings.ToLower(s.Pubkey)
        if !whitelist[k] || seen[k] {
            continue
        }
        if verifySig(s.Pubkey, s.Signature, digest[:]) {
            seen[k] = true
            valid++
        }
    }

    // 4. Enough approvals?
    if valid < p.CanonicalMessage.Threshold {
        return errors.New("not enough valid signatures")
    }
    return nil
}

func verifySig(pubHex, sigHex string, digest []byte) bool {
    pb, _ := hex.DecodeString(strings.TrimPrefix(pubHex, "0x"))
    sb, _ := hex.DecodeString(strings.TrimPrefix(sigHex, "0x"))
    pk, err := secp256k1.ParsePubKey(pb)
    if err != nil || len(sb) != 64 {
        return false
    }
    var r, s secp256k1.ModNScalar
    r.SetByteSlice(sb[:32])
    s.SetByteSlice(sb[32:])
    return ecdsa.NewSignature(&r, &s).Verify(digest, pk)
}

import { createHmac, createHash, timingSafeEqual } from "node:crypto";
import { secp256k1 } from "@noble/curves/secp256k1";

const bytes = (h: string) => Buffer.from(h.replace(/^0x/, ""), "hex");

// whitelist = Set of your team's known member public keys (lowercase 0x-hex).
export function verify(
  rawBody: string, xSig: string, xTs: string,
  hmacSecret: string, whitelist: Set<string>,
): boolean {
  // 1. Envelope: HMAC-SHA256(secret, timestamp + "." + rawBody)
  const want = createHmac("sha256", hmacSecret).update(xTs + "." + rawBody).digest("hex");
  if (want.length !== xSig.length || !timingSafeEqual(Buffer.from(want), Buffer.from(xSig))) {
    return false;
  }
  // (also reject if xTs is far from your clock)

  const p = JSON.parse(rawBody);

  // 2. Signed digest = SHA-256 of the canonical string.
  const digest = createHash("sha256").update(p.canonical_string).digest();

  // 3. Verify each signature against a whitelisted key.
  const seen = new Set<string>();
  let valid = 0;
  for (const s of p.signatures) {
    const k = s.pubkey.toLowerCase();
    if (!whitelist.has(k) || seen.has(k)) continue;
    if (secp256k1.verify(bytes(s.signature), digest, bytes(s.pubkey))) {
      seen.add(k);
      valid++;
    }
  }

  // 4. Enough approvals?
  return valid >= p.canonical_message.threshold;
}

import hashlib, hmac, json
from ecdsa import VerifyingKey, SECP256k1, BadSignatureError
from ecdsa.util import sigdecode_string

# whitelist = set of your team's known member public keys (lowercase 0x-hex).
def verify(raw_body: bytes, x_sig: str, x_ts: str, hmac_secret: str, whitelist: set) -> bool:
    # 1. Envelope: HMAC-SHA256(secret, timestamp + "." + raw_body)
    want = hmac.new(hmac_secret.encode(),
                    (x_ts + ".").encode() + raw_body,
                    hashlib.sha256).hexdigest()
    if not hmac.compare_digest(want, x_sig):
        return False
    # (also reject if x_ts is far from your clock)

    p = json.loads(raw_body)

    # 2. Signed digest = SHA-256 of the canonical string.
    digest = hashlib.sha256(p["canonical_string"].encode()).digest()

    # 3. Verify each signature against a whitelisted key.
    seen, valid = set(), 0
    for s in p["signatures"]:
        k = s["pubkey"].lower()
        if k not in whitelist or k in seen:
            continue
        vk = VerifyingKey.from_string(bytes.fromhex(s["pubkey"][2:]), curve=SECP256k1)
        try:
            vk.verify_digest(bytes.fromhex(s["signature"][2:]), digest,
                             sigdecode=sigdecode_string)
            seen.add(k); valid += 1
        except BadSignatureError:
            pass

    # 4. Enough approvals?
    return valid >= p["canonical_message"]["threshold"]

use hmac::{Hmac, Mac};
use sha2::{Digest, Sha256};
use std::collections::HashSet;
use k256::ecdsa::{signature::hazmat::PrehashVerifier, Signature, VerifyingKey};

// whitelist = your team's known member public keys (lowercase 0x-hex).
fn verify(raw_body: &[u8], x_sig: &str, x_ts: &str,
          hmac_secret: &str, whitelist: &HashSet<String>) -> bool {
    // 1. Envelope: HMAC-SHA256(secret, timestamp + "." + raw_body)
    let mut mac = <Hmac<Sha256>>::new_from_slice(hmac_secret.as_bytes()).unwrap();
    mac.update(x_ts.as_bytes());
    mac.update(b".");
    mac.update(raw_body);
    if hex::encode(mac.finalize().into_bytes()) != x_sig {
        return false; // use a constant-time compare in production
    }

    let p: serde_json::Value = serde_json::from_slice(raw_body).unwrap();

    // 2. Signed digest = SHA-256 of the canonical string.
    let digest = Sha256::digest(p["canonical_string"].as_str().unwrap().as_bytes());

    // 3. Verify each signature against a whitelisted key.
    let threshold = p["canonical_message"]["threshold"].as_u64().unwrap();
    let (mut seen, mut valid) = (HashSet::new(), 0u64);
    for s in p["signatures"].as_array().unwrap_or(&vec![]) {
        let pk = s["pubkey"].as_str().unwrap().trim_start_matches("0x");
        let sg = s["signature"].as_str().unwrap().trim_start_matches("0x");
        let k = pk.to_lowercase();
        if !whitelist.contains(&k) || seen.contains(&k) { continue; }
        if let (Ok(vk), Ok(sig)) = (
            VerifyingKey::from_sec1_bytes(&hex::decode(pk).unwrap()),
            Signature::from_slice(&hex::decode(sg).unwrap()),
        ) {
            if vk.verify_prehash(&digest, &sig).is_ok() { seen.insert(k); valid += 1; }
        }
    }

    // 4. Enough approvals?
    valid >= threshold
}