Verifying requests

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyTelzino(rawBody, headers, secret) {
  const ts = Number(headers['x-telzino-timestamp']);
  if (!Number.isFinite(ts) || Math.abs(Date.now() / 1000 - ts) > 300) return false;
  const expected = createHmac('sha256', secret).update(`${ts}.${rawBody}`).digest();
  return String(headers['x-telzino-signature'] ?? '').split(',').some((part) => {
    const hex = part.trim().replace(/^v1=/, '');
    const got = Buffer.from(hex, 'hex');
    return got.length === expected.length && timingSafeEqual(got, expected);
  });
}

import hashlib, hmac, time

def verify_telzino(raw_body: bytes, headers, secret: str) -> bool:
    h = {k.lower(): v for k, v in headers.items()}  # header names are case-insensitive
    try:
        ts = int(h.get("x-telzino-timestamp", ""))
    except ValueError:
        return False
    if abs(time.time() - ts) > 300:
        return False
    expected = hmac.new(secret.encode(), f"{ts}.".encode() + raw_body, hashlib.sha256).hexdigest().encode()
    return any(hmac.compare_digest(p.strip().removeprefix("v1=").encode(), expected)
               for p in h.get("x-telzino-signature", "").split(","))