import crypto from 'node:crypto';

export function verifyLinkitWebhook(secret, headers, rawBody, toleranceSec = 300) {
  const id = headers['webhook-id'];
  const ts = Number(headers['webhook-timestamp']);
  if (!Number.isFinite(ts) || Math.abs(Date.now() / 1000 - ts) > toleranceSec) return false;
  const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64');
  const expected = crypto.createHmac('sha256', key).update(`${id}.${ts}.`).update(rawBody).digest('base64');
  return headers['webhook-signature'].split(' ').some((candidate) => {
    const [version, signature] = candidate.split(',');
    return version === 'v1' && signature.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  });
}

import base64, hashlib, hmac, time

def verify_linkit_webhook(secret: str, headers: dict, raw_body: bytes, tolerance: int = 300) -> bool:
    msg_id, ts = headers["webhook-id"], headers["webhook-timestamp"]
    if abs(time.time() - int(ts)) > tolerance:
        return False
    key = base64.b64decode(secret.removeprefix("whsec_"))
    mac = hmac.new(key, f"{msg_id}.{ts}.".encode() + raw_body, hashlib.sha256)
    expected = "v1," + base64.b64encode(mac.digest()).decode()
    return any(hmac.compare_digest(expected, sig) for sig in headers["webhook-signature"].split())

func VerifyLinkitWebhook(secret string, h http.Header, body []byte, now time.Time) bool {
	ts, err := strconv.ParseInt(h.Get("webhook-timestamp"), 10, 64)
	if err != nil || math.Abs(float64(now.Unix()-ts)) > 300 {
		return false
	}
	key, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(secret, "whsec_"))
	if err != nil {
		return false
	}
	mac := hmac.New(sha256.New, key)
	fmt.Fprintf(mac, "%s.%d.", h.Get("webhook-id"), ts)
	mac.Write(body)
	expected := "v1," + base64.StdEncoding.EncodeToString(mac.Sum(nil))
	for _, sig := range strings.Fields(h.Get("webhook-signature")) {
		if hmac.Equal([]byte(sig), []byte(expected)) {
			return true
		}
	}
	return false
}

public static bool VerifyLinkitWebhook(string secret, string id, string timestamp, byte[] body, string signatureHeader)
{
    if (!long.TryParse(timestamp, out var ts) || Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - ts) > 300) return false;
    var key = Convert.FromBase64String(secret.StartsWith("whsec_") ? secret[6..] : secret);
    using var hmac = new System.Security.Cryptography.HMACSHA256(key);
    var prefix = System.Text.Encoding.UTF8.GetBytes($"{id}.{ts}.");
    var expected = "v1," + Convert.ToBase64String(hmac.ComputeHash(prefix.Concat(body).ToArray()));
    return signatureHeader.Split(' ').Any(sig => System.Security.Cryptography.CryptographicOperations.FixedTimeEquals(
        System.Text.Encoding.ASCII.GetBytes(sig), System.Text.Encoding.ASCII.GetBytes(expected)));
}

function verify_linkit_webhook(string $secret, array $h, string $rawBody, int $tolerance = 300): bool {
    $ts = (int) $h['webhook-timestamp'];
    if (abs(time() - $ts) > $tolerance) return false;
    $key = base64_decode(preg_replace('/^whsec_/', '', $secret));
    $expected = 'v1,' . base64_encode(hash_hmac('sha256', "{$h['webhook-id']}.{$ts}.{$rawBody}", $key, true));
    foreach (explode(' ', $h['webhook-signature']) as $sig) {
        if (hash_equals($expected, $sig)) return true;
    }
    return false;
}