Verify webhook signatures (HMAC-SHA256)

import hashlib
import hmac

def verify_signature(payload_bytes: bytes, signature_header: str, secret: str) -> bool:
    if not signature_header or not secret:
        return False

    if "=" not in signature_header:
        return False

    algo, expected = signature_header.split("=", 1)
    if algo != "sha256":
        return False

    computed = hmac.new(secret.encode("utf-8"), payload_bytes, hashlib.sha256).hexdigest()
    return hmac.compare_digest(computed, expected)

import crypto from 'node:crypto';

export function verifySignature(payloadBytes, signatureHeader, secret) {
    if (!signatureHeader || !secret) return false;
    const parts = signatureHeader.split('=');
    if (parts.length < 2) return false;

    const algo = parts[0];
    const expected = parts.slice(1).join('=');
    if (algo !== 'sha256') return false;

    const computed = crypto
        .createHmac('sha256', Buffer.from(secret, 'utf8'))
        .update(payloadBytes)
        .digest('hex');

    return crypto.timingSafeEqual(Buffer.from(computed, 'utf8'), Buffer.from(expected, 'utf8'));
}