هشدار قیمت و وبهوک

import crypto from "node:crypto";
import express from "express";

const app = express();
app.post("/hooks/netarz-fx", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("X-NetArz-Signature") || "";
  const t = header.match(/t=(\d+)/)?.[1];
  const v1 = header.match(/v1=([a-f0-9]+)/)?.[1];
  if (!t || !v1) return res.status(400).end();

  // ۱) پنجرهٔ زمانی ۵ دقیقه‌ای در برابر replay
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return res.status(400).end();

  // ۲) HMAC-SHA256 روی "<t>.<body خام>"
  const expected = crypto.createHmac("sha256", process.env.NETARZ_FX_WEBHOOK_SECRET)
    .update(`${t}.${req.body.toString("utf8")}`).digest("hex");
  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1))) return res.status(401).end();

  const event = JSON.parse(req.body);
  console.log(event.event, event.rate.code, event.rate.mid);
  res.status(200).end();   // هر 2xx = تحویل شد
});

<?php
// Laravel — routes/api.php (بدون CSRF)
Route::post('/hooks/netarz-fx', function (\Illuminate\Http\Request $request) {
    $header = (string) $request->header('X-NetArz-Signature');
    preg_match('/t=(\d+)/', $header, $t);
    preg_match('/v1=([a-f0-9]+)/', $header, $v1);

    abort_unless($t && $v1, 400);
    abort_if(abs(time() - (int) $t[1]) > 300, 400);

    $expected = hash_hmac('sha256', $t[1].'.'.$request->getContent(), config('services.netarz.webhook_secret'));
    abort_unless(hash_equals($expected, $v1[1]), 401);

    $event = $request->json()->all();
    // … کاری که می‌خواهید: ذخیره، پیام تلگرام، تغییر قیمت محصولات
    return response()->noContent();
});

import hmac, hashlib, time, json
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = b"whsec_..."

@app.post("/hooks/netarz-fx")
def hook():
    sig = request.headers.get("X-NetArz-Signature", "")
    parts = dict(p.split("=", 1) for p in sig.split(","))
    if abs(time.time() - int(parts["t"])) > 300:
        abort(400)
    expected = hmac.new(SECRET, f'{parts["t"]}.'.encode() + request.get_data(), hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, parts["v1"]):
        abort(401)
    event = json.loads(request.get_data())
    print(event["event"], event["rate"]["mid"])
    return "", 200