import crypto from "node:crypto";

function verifyWebhookSignature(payload, signature, secret) {
const elements = signature.split(",");
const timestamp = elements.find((el) => el.startsWith("t="))?.split("=")[1];
const v1 = elements.find((el) => el.startsWith("v1="))?.split("=")[1];

if (!timestamp || !v1) return false;

const payloadToSign = `${timestamp}.${payload}`;
const expectedSignature = crypto
.createHmac("sha256", secret)
.update(payloadToSign, "utf8")
.digest("hex");

// Convert both signatures to Buffer for constant time comparison
const receivedSignatureBuffer = Buffer.from(v1, "hex");
const expectedSignatureBuffer = Buffer.from(expectedSignature, "hex");

// Ensure both buffers are the same length
if (receivedSignatureBuffer.length !== expectedSignatureBuffer.length) {
return false;
}

// Constant time comparison
return crypto.timingSafeEqual(
receivedSignatureBuffer,
expectedSignatureBuffer
);
}

// Ejemplo de uso en Express.js
app.post('/webhook', express.raw({type: 'application/json'}), (req, res) => {
const signature = req.headers['trebol-signature'];
const payload = req.body.toString();

if (!verifyWebhookSignature(payload, signature, process.env.WEBHOOK_SECRET)) {
return res.status(401).send('Invalid signature');
}

// Procesar webhook...
res.status(200).send('OK');
});

import hmac
import hashlib
import time
from typing import Optional

def verify_webhook_signature(payload: str, signature: str, secret: str) -> bool:
    """
    Verifica la firma HMAC-SHA256 de un webhook de Trébol.

    Args:
        payload: El cuerpo del webhook como string
        signature: El header Trebol-Signature
        secret: El secreto del webhook

    Returns:
        True si la firma es válida, False en caso contrario
    """
    try:
        # Extraer elementos del header
        elements = signature.split(',')
        timestamp = None
        v1 = None

        for element in elements:
            if element.startswith('t='):
                timestamp = element.split('=')[1]
            elif element.startswith('v1='):
                v1 = element.split('=')[1]

        if not timestamp or not v1:
            return False

        # Construir payload para firmar
        payload_to_sign = f"{timestamp}.{payload}"

        # Generar firma esperada
        expected_signature = hmac.new(
            secret.encode('utf-8'),
            payload_to_sign.encode('utf-8'),
            hashlib.sha256
        ).hexdigest()

        # Comparación de tiempo constante
        return hmac.compare_digest(v1, expected_signature)

    except Exception:
        return False

# Ejemplo de uso en Flask
from flask import Flask, request, abort

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('Trebol-Signature')
    payload = request.get_data(as_text=True)

    if not verify_webhook_signature(payload, signature, app.config['WEBHOOK_SECRET']):
        abort(401)

    # Procesar webhook...
    return 'OK', 200

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.Arrays;

public class WebhookSignatureVerifier {

    /**
     * Verifica la firma HMAC-SHA256 de un webhook de Trébol.
     *
     * @param payload El cuerpo del webhook como string
     * @param signature El header Trebol-Signature
     * @param secret El secreto del webhook
     * @return true si la firma es válida, false en caso contrario
     */
    public static boolean verifyWebhookSignature(String payload, String signature, String secret) {
        try {
            // Extraer elementos del header
            String[] elements = signature.split(",");
            String timestamp = null;
            String v1 = null;

            for (String element : elements) {
                if (element.startsWith("t=")) {
                    timestamp = element.split("=")[1];
                } else if (element.startsWith("v1=")) {
                    v1 = element.split("=")[1];
                }
            }

            if (timestamp == null || v1 == null) {
                return false;
            }

            // Construir payload para firmar
            String payloadToSign = timestamp + "." + payload;

            // Generar firma esperada
            Mac mac = Mac.getInstance("HmacSHA256");
            SecretKeySpec secretKeySpec = new SecretKeySpec(
                secret.getBytes(StandardCharsets.UTF_8),
                "HmacSHA256"
            );
            mac.init(secretKeySpec);

            byte[] expectedSignatureBytes = mac.doFinal(
                payloadToSign.getBytes(StandardCharsets.UTF_8)
            );
            String expectedSignature = bytesToHex(expectedSignatureBytes);

            // Comparación de tiempo constante
            return constantTimeEquals(v1, expectedSignature);

        } catch (NoSuchAlgorithmException | InvalidKeyException e) {
            return false;
        }
    }

    private static String bytesToHex(byte[] bytes) {
        StringBuilder result = new StringBuilder();
        for (byte b : bytes) {
            result.append(String.format("%02x", b));
        }
        return result.toString();
    }

    private static boolean constantTimeEquals(String a, String b) {
        if (a.length() != b.length()) {
            return false;
        }

        byte[] aBytes = a.getBytes(StandardCharsets.UTF_8);
        byte[] bBytes = b.getBytes(StandardCharsets.UTF_8);

        return Arrays.equals(aBytes, bBytes);
    }
}

// Ejemplo de uso en Spring Boot
@RestController
public class WebhookController {

    @Value("${webhook.secret}")
    private String webhookSecret;

    @PostMapping("/webhook")
    public ResponseEntity<String> webhook(@RequestBody String payload,
                                        @RequestHeader("Trebol-Signature") String signature) {

        if (!WebhookSignatureVerifier.verifyWebhookSignature(payload, signature, webhookSecret)) {
            return ResponseEntity.status(401).body("Invalid signature");
        }

        // Procesar webhook...
        return ResponseEntity.ok("OK");
    }
}

{
  "event_name": "verification.v2.document_status_updated",
  "data": {
    "verification_id": "c8dc41fc-c477-404e-aff7-b9074f86d6d1",
    "account_id": "66b4b55e-0e4f-42ec-9727-2bff88965562",
    "created_at": "2026-07-01T15:04:12.318Z",
    "status": "pending",
    "verification_tag": "cliente-12345",
    "documents_status": "full_upload",
    "previous_documents_status": "partial_upload",
    "updated_at": "2026-07-01T16:22:40.907Z"
  }
}

{
  "event_name": "verification.v2.document_status_updated",
  "data": {
    "verification_id": "c8dc41fc-c477-404e-aff7-b9074f86d6d1",
    "account_id": "66b4b55e-0e4f-42ec-9727-2bff88965562",
    "created_at": "2026-07-01T15:04:12.318Z",
    "status": "pending",
    "verification_tag": "cliente-12345",
    "documents_status": "partial_upload",
    "previous_documents_status": "full_upload",
    "updated_at": "2026-07-03T09:14:02.113Z"
  }
}

{
  "event_name": "verification.v2.document_status_updated",
  "data": {
    "verification_id": "c8dc41fc-c477-404e-aff7-b9074f86d6d1",
    "account_id": "66b4b55e-0e4f-42ec-9727-2bff88965562",
    "created_at": "2026-07-01T15:04:12.318Z",
    "status": "pending",
    "verification_tag": "cliente-12345",
    "documents_status": "partial_upload",
    "previous_documents_status": null,
    "updated_at": "2026-07-01T15:18:03.442Z"
  }
}

curl -X POST "https://api.gotrebol.com/v2/webhooks" \
     -H "x-api-key: {api_key}" \
     -H "Content-Type: application/json" \
     -d '{
       "url": "https://tu-app.com/webhooks/trebol",
       "events": ["verification.v2.findings.updated"],
       "description": "Hallazgos de la verificación"
     }'

curl -X PUT "https://api.gotrebol.com/v2/webhooks/{webhookId}" \
     -H "x-api-key: {api_key}" \
     -H "Content-Type: application/json" \
     -d '{
       "events": ["verification.v2.finished", "verification.v2.findings.updated"]
     }'

{
  "event_name": "verification.v2.findings.updated",
  "data": {
    "verification_id": "5853393e-8cf7-4dc7-afd9-a92df69fff2b",
    "account_id": "212457cc-09bb-4308-b69b-f719e6f2eb03",
    "findings": [
      {
        "severity": "high",
        "message": "Falta el poder notarial del representante legal",
        "missing_field": "pw_mx"
      },
      {
        "severity": "low",
        "message": "El domicilio del comprobante no coincide con el del acta"
      }
    ],
    "source": "provisional",
    "computed_at": "2025-01-15T11:05:27.000Z",
    "run_id": "0f6a1c2e-8f1b-4d2a-9c33-5b1f6e2a7d10"
  }
}

{
  "event_name": "verification.v2.findings.updated",
  "data": {
    "verification_id": "5853393e-8cf7-4dc7-afd9-a92df69fff2b",
    "account_id": "212457cc-09bb-4308-b69b-f719e6f2eb03",
    "findings": [
      {
        "severity": "high",
        "message": "Falta el poder notarial del representante legal",
        "missing_field": "pw_mx"
      }
    ],
    "source": "final",
    "computed_at": "2025-01-15T12:40:03.000Z",
    "run_id": "b21e7d44-1a90-4f6c-8f02-9c7e3a5d1188"
  }
}

{
  "event_name": "verification.v2.findings.updated",
  "data": {
    "verification_id": "5853393e-8cf7-4dc7-afd9-a92df69fff2b",
    "account_id": "212457cc-09bb-4308-b69b-f719e6f2eb03",
    "findings": [],
    "source": "final",
    "computed_at": "2025-01-15T12:40:03.000Z",
    "run_id": "b21e7d44-1a90-4f6c-8f02-9c7e3a5d1188"
  }
}

{
  "event_name": "verification_people.curp_search_completed",
  "data": {
    "verification_id": "5853393e-8cf7-4dc7-afd9-a92df69fff2b",
    "item_id": 32644,
    "people_id": 3921,
    "shareholder_id": 18590,
    "account_name": "trebol",
    "account_id": "212457cc-09bb-4308-b69b-f719e6f2eb03",
    "verification_tag": "personidgeneric-uuid"
  }
}

{
  "event_name": "verification_people.curp_search_completed",
  "data": {
    "verification_id": "c0361bc7-9318-4b09-8186-4ee451cc569f",
    "item_id": 32640,
    "people_error": "curp_format_error",
    "people_error_message": "CURP is required and must be a string",
    "people_id": 3908,
    "account_name": "trebol",
    "account_id": "212457cc-09bb-4308-b69b-f719e6f2eb03",
    "verification_tag": "personidgeneric-uuid"
  }
}