import crypto from 'crypto';

function verifyWebhook(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return `sha256=${expected}` === signature;
}

// Express example
app.post('/webhooks/ta', (req, res) => {
  const signature = req.headers['x-totalaccess-signature'];
  const rawBody = req.rawBody; // Use raw body, not parsed JSON

  if (!verifyWebhook(rawBody, signature, process.env.TA_WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const payload = JSON.parse(rawBody);
  // Process the event...
  res.status(200).json({ received: true });
});

import hmac
import hashlib

def verify_webhook(raw_body, signature, secret):
    expected = hmac.new(
        secret.encode('utf-8'),
        raw_body,
        hashlib.sha256
    ).hexdigest()
    return f"sha256={expected}" == signature

# Flask example
@app.route('/webhooks/ta', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-TotalAccess-Signature')
    raw_body = request.get_data()

    if not verify_webhook(raw_body, signature, os.environ['TA_WEBHOOK_SECRET']):
        return jsonify({'error': 'Invalid signature'}), 401

    payload = request.json
    # Process the event...
    return jsonify({'received': True}), 200

function verifyWebhook($rawBody, $signature, $secret) {
    $expected = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);
    return hash_equals($expected, $signature);
}

// In your webhook handler
$rawBody = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_TOTALACCESS_SIGNATURE'] ?? '';

if (!verifyWebhook($rawBody, $signature, $_ENV['TA_WEBHOOK_SECRET'])) {
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

$payload = json_decode($rawBody, true);
// Process the event...
http_response_code(200);
echo json_encode(['received' => true]);