const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const [timestamp, hash] = signature.split(',').map(s => s.split('=')[1]);
  
  // Check timestamp is recent (within 5 minutes)
  const age = Date.now() / 1000 - parseInt(timestamp);
  if (age > 300) {
    throw new Error('Webhook timestamp too old');
  }
  
  // Verify signature
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${payload}`)
    .digest('hex');
    
  if (hash !== expected) {
    throw new Error('Invalid webhook signature');
  }
  
  return true;
}

// In your webhook handler
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-ringyo-signature'];
  const payload = JSON.stringify(req.body);
  
  try {
    verifyWebhook(payload, signature, process.env.WEBHOOK_SECRET);
    // Process the webhook
    res.sendStatus(200);
  } catch (error) {
    res.sendStatus(401);
  }
});

import hmac
import hashlib
import time

def verify_webhook(payload: str, signature: str, secret: str) -> bool:
    parts = dict(p.split('=') for p in signature.split(','))
    timestamp = parts['t']
    received_hash = parts['v1']
    
    # Check timestamp is recent
    age = time.time() - int(timestamp)
    if age > 300:
        raise ValueError('Webhook timestamp too old')
    
    # Verify signature
    expected = hmac.new(
        secret.encode(),
        f"{timestamp}.{payload}".encode(),
        hashlib.sha256
    ).hexdigest()
    
    if not hmac.compare_digest(received_hash, expected):
        raise ValueError('Invalid webhook signature')
    
    return True