Verify webhook signatures

Biqli-Signature = lowercase_hex(HMAC_SHA256(raw_request_body, signing_secret))

import {createHmac, timingSafeEqual} from 'node:crypto';

export async function POST(request: Request) {
  const rawBody = await request.text();
  const received = request.headers.get('biqli-signature') ?? '';
  const expected = createHmac(
    'sha256',
    process.env.BIQLI_WEBHOOK_SECRET!,
  ).update(rawBody).digest('hex');

  const validFormat = /^[a-f0-9]{64}$/.test(received);
  const valid = validFormat && timingSafeEqual(
    Buffer.from(received, 'hex'),
    Buffer.from(expected, 'hex'),
  );

  if (!valid) {
    return new Response('Invalid signature', {status: 401});
  }

  const event = JSON.parse(rawBody);
  await safelyAcceptOnce(event.id, event);
  return new Response('Accepted', {status: 200});
}

<?php

$rawBody = file_get_contents('php://input');
$received = $_SERVER['HTTP_BIQLI_SIGNATURE'] ?? '';
$expected = hash_hmac(
    'sha256',
    $rawBody,
    $_ENV['BIQLI_WEBHOOK_SECRET'],
);

if (!preg_match('/^[a-f0-9]{64}$/', $received)
    || !hash_equals($expected, $received)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($rawBody, true, flags: JSON_THROW_ON_ERROR);
safelyAcceptOnce($event['id'], $event);
http_response_code(200);