Signing

import crypto from "node:crypto";

export function verifyMatterSignature(rawBody, header, secret) {
  const parts = Object.fromEntries(
    header.split(",").map((p) => p.split("=")),
  );
  const ts = parts.t;
  const sig = parts.v1;
  if (!ts || !sig) throw new Error("Malformed signature header");

  // 5-minute replay window
  const age = Math.abs(Math.floor(Date.now() / 1000) - parseInt(ts, 10));
  if (age > 300) throw new Error("Timestamp outside replay window");

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${ts}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(sig, "hex");
  const b = Buffer.from(expected, "hex");
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    throw new Error("Signature mismatch");
  }
}

import hashlib
import hmac
import time

def verify_matter_signature(raw_body: bytes, header: str, secret: str) -> None:
    parts = dict(p.split("=", 1) for p in header.split(","))
    ts, sig = parts.get("t"), parts.get("v1")
    if not ts or not sig:
        raise ValueError("Malformed signature header")

    # 5-minute replay window
    if abs(int(time.time()) - int(ts)) > 300:
        raise ValueError("Timestamp outside replay window")

    signed_payload = f"{ts}.".encode() + raw_body
    expected = hmac.new(secret.encode(), signed_payload, hashlib.sha256).hexdigest()

    if not hmac.compare_digest(sig, expected):
        raise ValueError("Signature mismatch")

package webhooks

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "errors"
    "fmt"
    "strconv"
    "strings"
    "time"
)

func VerifyMatterSignature(rawBody []byte, header, secret string) error {
    var ts, sig string
    for _, p := range strings.Split(header, ",") {
        kv := strings.SplitN(p, "=", 2)
        if len(kv) != 2 {
            continue
        }
        switch kv[0] {
        case "t":
            ts = kv[1]
        case "v1":
            sig = kv[1]
        }
    }
    if ts == "" || sig == "" {
        return errors.New("malformed signature header")
    }

    sent, err := strconv.ParseInt(ts, 10, 64)
    if err != nil {
        return fmt.Errorf("invalid timestamp: %w", err)
    }
    if delta := time.Now().Unix() - sent; delta > 300 || delta < -300 {
        return errors.New("timestamp outside replay window")
    }

    mac := hmac.New(sha256.New, []byte(secret))
    fmt.Fprintf(mac, "%s.", ts)
    mac.Write(rawBody)
    expected := mac.Sum(nil)

    got, err := hex.DecodeString(sig)
    if err != nil {
        return fmt.Errorf("invalid signature hex: %w", err)
    }
    if !hmac.Equal(got, expected) {
        return errors.New("signature mismatch")
    }
    return nil
}