Webhook Management

# Signature verification is done server-side.

<?php

function verifyRassmiSignature(string $rawBody, string $signingSecret, string $signatureHeader): bool
{
    if (!str_starts_with($signatureHeader, 'sha256=')) {
        return false;
    }

    $expectedSig = 'sha256=' . hash_hmac('sha256', $rawBody, $signingSecret);

    return hash_equals($expectedSig, $signatureHeader);
}

// In your controller:
$rawBody  = $request->getContent();
$sigHeader = $request->header('X-Rassmi-Signature');

if (!verifyRassmiSignature($rawBody, 'your_signing_secret', $sigHeader)) {
    abort(401, 'Invalid webhook signature');
}

const crypto = require('crypto');

function verifyRassmiSignature(rawBody, signingSecret, sigHeader) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', signingSecret)
    .update(rawBody, 'utf8')
    .digest('hex');

  // Use timing-safe comparison
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(sigHeader)
  );
}

// Express.js example:
app.post('/hooks/rassmi', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.headers['x-rassmi-signature'];
  if (!verifyRassmiSignature(req.body, process.env.RASSMI_SECRET, sig)) {
    return res.status(401).send('Unauthorized');
  }
  // Process event...
  res.sendStatus(200);
});

<?php

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;

Route::post('/hooks/rassmi', function (Request $request) {
    $rawBody   = $request->getContent();
    $sigHeader = $request->header('X-Rassmi-Signature');
    $secret    = config('services.rassmi.webhook_secret');

    $expected  = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);

    if (! hash_equals($expected, (string) $sigHeader)) {
        abort(401, 'Invalid signature');
    }

    $event = $request->json('event');
    $data  = $request->json('data');

    // Handle event...
    return response()->noContent();
})->withoutMiddleware([
    \Illuminate\Foundation\Http\Middleware\VerifyCsrfToken::class,
]);