Avisos (webhooks)

import crypto from 'node:crypto'
import express from 'express'

const app = express()
app.post('/impulso', express.raw({ type: 'application/json' }), (req, res) => {
  const [t, v1] = req.get('X-Impulso-Signature').split(',').map((p) => p.split('=')[1])
  const esperado = crypto.createHmac('sha256', process.env.IMPULSO_WEBHOOK_SECRET).update(`${t}.${req.body}`).digest('hex')
  const valida = v1.length === esperado.length && crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(esperado))
  if (!valida || Math.abs(Date.now() / 1000 - Number(t)) > 300) return res.sendStatus(401)
  res.sendStatus(200) // responde rápido y procesa después
  const aviso = JSON.parse(req.body)
  // …
})

import hmac, hashlib, os, time
from flask import Flask, request

app = Flask(__name__)

@app.post("/impulso")
def impulso():
    t, v1 = [p.split("=")[1] for p in request.headers["X-Impulso-Signature"].split(",")]
    cuerpo = request.get_data()
    esperado = hmac.new(os.environ["IMPULSO_WEBHOOK_SECRET"].encode(), f"{t}.".encode() + cuerpo, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(v1, esperado) or abs(time.time() - int(t)) > 300:
        return "", 401
    return "", 200