Verify signatures

import { createHmac, timingSafeEqual } from 'node:crypto'

export function verify(rawBody, header, secret) {
  const parts = header.split(',')
  const t = parts.find((part) => part.startsWith('t='))?.slice(2) ?? ''
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false
  const mac = createHmac('sha256', secret).update(`${t}.`).update(rawBody).digest()
  return parts.filter((part) => part.startsWith('v1=')).some((part) => {
    const got = Buffer.from(part.slice(3), 'hex')
    return got.length === mac.length && timingSafeEqual(got, mac)
  })
}

import hashlib, hmac, time

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    parts = header.split(',')
    t = next((p[2:] for p in parts if p.startswith('t=')), '')
    if not t.isdigit() or abs(time.time() - int(t)) > 300:
        return False
    mac = hmac.new(secret.encode(), f'{t}.'.encode() + raw_body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(p[3:], mac) for p in parts if p.startswith('v1='))

function verify(string $rawBody, string $header, string $secret): bool {
    $t = '';
    $given = [];
    foreach (explode(',', $header) as $part) {
        if (str_starts_with($part, 't=')) $t = substr($part, 2);
        if (str_starts_with($part, 'v1=')) $given[] = substr($part, 3);
    }
    if (!ctype_digit($t) || abs(time() - (int) $t) > 300) return false;
    $mac = hash_hmac('sha256', $t . '.' . $rawBody, $secret);
    foreach ($given as $v) if (hash_equals($mac, $v)) return true;
    return false;
}

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"math"
	"strconv"
	"strings"
	"time"
)

func Verify(rawBody []byte, header, secret string) bool {
	var t string
	var given []string
	for _, part := range strings.Split(header, ",") {
		if strings.HasPrefix(part, "t=") {
			t = part[2:]
		} else if strings.HasPrefix(part, "v1=") {
			given = append(given, part[3:])
		}
	}
	sec, err := strconv.ParseInt(t, 10, 64)
	if err != nil || math.Abs(float64(time.Now().Unix()-sec)) > 300 {
		return false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(t + "."))
	mac.Write(rawBody)
	want := hex.EncodeToString(mac.Sum(nil))
	for _, v := range given {
		if hmac.Equal([]byte(v), []byte(want)) {
			return true
		}
	}
	return false
}

require 'openssl'

def verify(raw_body, header, secret)
  parts = header.split(',')
  t = parts.find { |p| p.start_with?('t=') }&.delete_prefix('t=').to_s
  return false unless t.match?(/\A\d+\z/) && (Time.now.to_i - t.to_i).abs <= 300
  mac = OpenSSL::HMAC.hexdigest('SHA256', secret, "#{t}.#{raw_body}")
  parts.select { |p| p.start_with?('v1=') }.any? { |p| OpenSSL.fixed_length_secure_compare(p.delete_prefix('v1='), mac) rescue false }
end

createHmac('sha256', process.env.PLAYGENT_SIGNING_SECRET).update(String(user.id)).digest('hex')

hmac.new(os.environ['PLAYGENT_SIGNING_SECRET'].encode(), str(user_id).encode(), hashlib.sha256).hexdigest()

hash_hmac('sha256', (string) $userId, getenv('PLAYGENT_SIGNING_SECRET'))