Webhook

import json
from flask import request

# Replace with the publicKey returned at webhook registration
PUBLIC_KEY = "YOUR_PUBLIC_KEY"

def callback_notice():
    # 1. Read the raw body and signature header
    param = request.get_data(as_text=True)
    signature = request.headers.get("signature")

    # 2. Verify RSA-SHA256 (signature is hex-encoded)
    verified = sha256_rsa_verify(param, signature, PUBLIC_KEY)
    print(f"verified: {verified}")

    # 3. Acknowledge receipt
    return json.dumps({
        "callbackStatus": "SUCCESS" if verified else "FAIL"
    })

def sha256_rsa_verify(data: str, signature: str, public_key_b64: str) -> bool:
    """
    Verify an RSA-SHA256 signature.

    :param data:           The raw request body string that was signed.
    :param signature:      Hex-encoded RSA-SHA256 signature from the header.
    :param public_key_b64: Base64-encoded (X.509) RSA public key.
    :return:               True if the signature is valid, False otherwise.
    """
    from cryptography.hazmat.primitives import hashes, serialization
    from cryptography.hazmat.primitives.asymmetric import padding
    import base64

    try:
        pub_key_bytes = base64.b64decode(public_key_b64)
        public_key = serialization.load_der_public_key(pub_key_bytes)
        sig_bytes = bytes.fromhex(signature)
        public_key.verify(
            sig_bytes,
            data.encode("utf-8"),
            padding.PKCS1v15(),
            hashes.SHA256()
        )
        return True
    except Exception:
        return False

const crypto = require("crypto");

// Replace with the publicKey returned at webhook registration
const PUBLIC_KEY = "YOUR_PUBLIC_KEY";

async function callbackNotice(req, res) {
    // 1. Read the raw body and signature header
    const param = req.body; // raw string — ensure body-parser is set to 'text'
    const signature = req.headers["signature"];

    // 2. Verify RSA-SHA256 (signature is hex-encoded)
    const verified = verifyRSASHA256(param, signature, PUBLIC_KEY);
    console.log(`verified: ${verified}`);

    // 3. Acknowledge receipt
    res.json({ callbackStatus: verified ? "SUCCESS" : "FAIL" });
}

function verifyRSASHA256(data, hexSignature, publicKeyB64) {
    try {
        // Reconstruct the PEM-formatted public key from Base64
        const pem = `-----BEGIN PUBLIC KEY-----\n${publicKeyB64}\n-----END PUBLIC KEY-----`;
        const verify = crypto.createVerify("RSA-SHA256");
        verify.update(data, "utf8");
        // Convert hex signature to Buffer
        const sigBuffer = Buffer.from(hexSignature, "hex");
        return verify.verify(pem, sigBuffer);
    } catch (err) {
        console.error(err);
        return false;
    }
}