Webhooks

import hashlib
import hmac
import json
import time


def verify_webhook(
    raw_body: bytes,
    timestamp: str,
    signature: str,
    verification_key: str,
    max_age_seconds: int = 300,
) -> bool:
    if (
        len(signature) != 64 or not signature.isascii()
        or not timestamp.isascii() or not timestamp.isdecimal()
    ):
        return False

    try:
        if abs(int(time.time()) - int(timestamp)) > max_age_seconds:
            return False
        payload = json.loads(raw_body)
        canonical_body = json.dumps(
            payload, sort_keys=True, separators=(",", ":"), ensure_ascii=False,
            allow_nan=False,
        )
    except (ValueError, UnicodeDecodeError):
        return False

    expected = hmac.new(
        verification_key.encode("utf-8"),
        f"{canonical_body}{timestamp}".encode("utf-8"),
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, signature)