Webhooks

import express from 'express'
import { createHmac, timingSafeEqual } from 'node:crypto'

const SECRET = process.env.PLAYGENT_WEBHOOK_SECRET
const app = express()

app.post('/hooks/playgent', express.raw({ type: 'application/json' }), (req, res) => {
  const parts = String(req.get('Playgent-Signature') ?? '').split(',')
  const t = parts.find((part) => part.startsWith('t='))?.slice(2) ?? ''
  const mac = createHmac('sha256', SECRET).update(`${t}.`).update(req.body).digest()
  const signed = parts.filter((part) => part.startsWith('v1=')).some((part) => {
    const got = Buffer.from(part.slice(3), 'hex')
    return got.length === mac.length && timingSafeEqual(got, mac)
  })
  const fresh = Math.abs(Date.now() / 1000 - Number(t)) < 300

  const event = JSON.parse(req.body.toString('utf8'))
  if (event.type === 'test' && event.data.challenge && !SECRET) {
    return res.json({ challenge: event.data.challenge })
  }
  if (!signed || !fresh) return res.status(401).end()

  if (event.type === 'test') return res.json({ challenge: event.data.challenge })

  const { data } = event
  saveOnce(data.result, data)  // store by data.result, so a repeat is ignored
  if (data.verified && data.won && data.flags.length === 0) reward(data.reader.id, data)
  res.status(200).end()
})

import hashlib, hmac, json, os, time
from flask import Flask, request, jsonify

SECRET = os.environ.get('PLAYGENT_WEBHOOK_SECRET', '')
app = Flask(__name__)

@app.post('/hooks/playgent')
def playgent():
    raw = request.get_data()
    parts = request.headers.get('Playgent-Signature', '').split(',')
    t = next((p[2:] for p in parts if p.startswith('t=')), '')
    mac = hmac.new(SECRET.encode(), f'{t}.'.encode() + raw, hashlib.sha256).hexdigest()
    signed = any(hmac.compare_digest(p[3:], mac) for p in parts if p.startswith('v1='))
    fresh = t.isdigit() and abs(time.time() - int(t)) < 300

    event = json.loads(raw)
    if event['type'] == 'test' and event['data'].get('challenge') and not SECRET:
        return jsonify(challenge=event['data']['challenge'])
    if not (signed and fresh):
        return '', 401

    if event['type'] == 'test':
        return jsonify(challenge=event['data'].get('challenge'))

    data = event['data']
    save_once(data['result'], data)
    if data['verified'] and data['won'] and not data['flags']:
        reward(data['reader']['id'], data)
    return '', 200

<?php
$secret = getenv('PLAYGENT_WEBHOOK_SECRET') ?: '';
$raw = file_get_contents('php://input');
$parts = explode(',', $_SERVER['HTTP_PLAYGENT_SIGNATURE'] ?? '');
$t = '';
$given = [];
foreach ($parts as $part) {
    if (str_starts_with($part, 't=')) $t = substr($part, 2);
    if (str_starts_with($part, 'v1=')) $given[] = substr($part, 3);
}
$mac = hash_hmac('sha256', $t . '.' . $raw, $secret);
$signed = count(array_filter($given, fn ($v) => hash_equals($mac, $v))) > 0;
$fresh = ctype_digit($t) && abs(time() - (int) $t) < 300;

$event = json_decode($raw, true);
header('Content-Type: application/json');
if ($event['type'] === 'test' && !empty($event['data']['challenge']) && $secret === '') {
    echo json_encode(['challenge' => $event['data']['challenge']]);
    exit;
}
if (!$signed || !$fresh) { http_response_code(401); exit; }

if ($event['type'] === 'test') {
    echo json_encode(['challenge' => $event['data']['challenge'] ?? null]);
    exit;
}

$data = $event['data'];
save_once($data['result'], $data);
if ($data['verified'] && $data['won'] && count($data['flags']) === 0) {
    reward($data['reader']['id'], $data);
}
http_response_code(200);