The operator endpoint contract

import { createHash, createHmac, timingSafeEqual } from 'node:crypto';

const FRESH_SECONDS = 300;
const seenNonces = new Map<string, number>(); // nonce -> expiry (use Redis in production)

export function verify(
  secret: string,
  headers: Record<string, string>,
  method: string,
  path: string,
  rawBody: Buffer,
): boolean {
  const ts = headers['x-anyapi-timestamp'];
  const nonce = headers['x-anyapi-nonce'];
  const sig = headers['x-anyapi-signature'];
  if (!ts || !nonce || !sig) return false;

  const age = Math.abs(Date.now() / 1000 - Number(ts));
  if (!Number.isFinite(age) || age > FRESH_SECONDS) return false;

  const now = Date.now() / 1000;
  for (const [n, exp] of seenNonces) if (exp < now) seenNonces.delete(n);
  if (seenNonces.has(nonce)) return false;
  seenNonces.set(nonce, now + FRESH_SECONDS);

  const bodyHash = createHash('sha256').update(rawBody).digest('hex');
  const canonical = `${ts}.${nonce}.${method}.${path}.${bodyHash}`;
  const expected = createHmac('sha256', secret).update(canonical).digest('hex');

  const a = Buffer.from(sig, 'utf8');
  const b = Buffer.from(expected, 'utf8');
  return a.length === b.length && timingSafeEqual(a, b);
}

import hashlib
import hmac
import time

FRESH_SECONDS = 300
seen_nonces: dict[str, float] = {}  # nonce -> expiry (use Redis in production)


def verify(secret: str, headers: dict, method: str, path: str, raw_body: bytes) -> bool:
    ts = headers.get("x-anyapi-timestamp", "")
    nonce = headers.get("x-anyapi-nonce", "")
    sig = headers.get("x-anyapi-signature", "")
    if not ts or not nonce or not sig:
        return False

    try:
        if abs(time.time() - int(ts)) > FRESH_SECONDS:
            return False
    except ValueError:
        return False

    now = time.time()
    for n in [n for n, exp in seen_nonces.items() if exp < now]:
        del seen_nonces[n]
    if nonce in seen_nonces:
        return False
    seen_nonces[nonce] = now + FRESH_SECONDS

    body_hash = hashlib.sha256(raw_body).hexdigest()
    canonical = f"{ts}.{nonce}.{method}.{path}.{body_hash}"
    expected = hmac.new(secret.encode(), canonical.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(sig, expected)

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"crypto/subtle"
	"encoding/hex"
	"math"
	"net/http"
	"strconv"
	"sync"
	"time"
)

const freshSeconds = 300

var (
	nonceMu sync.Mutex
	nonces  = map[string]time.Time{} // nonce -> expiry (use Redis in production)
)

func verify(secret string, r *http.Request, path string, rawBody []byte) bool {
	ts := r.Header.Get("X-AnyAPI-Timestamp")
	nonce := r.Header.Get("X-AnyAPI-Nonce")
	sig := r.Header.Get("X-AnyAPI-Signature")
	if ts == "" || nonce == "" || sig == "" {
		return false
	}

	sec, err := strconv.ParseInt(ts, 10, 64)
	if err != nil || math.Abs(time.Since(time.Unix(sec, 0)).Seconds()) > freshSeconds {
		return false
	}

	nonceMu.Lock()
	now := time.Now()
	for n, exp := range nonces {
		if exp.Before(now) {
			delete(nonces, n)
		}
	}
	_, replay := nonces[nonce]
	nonces[nonce] = now.Add(freshSeconds * time.Second)
	nonceMu.Unlock()
	if replay {
		return false
	}

	bodyHash := sha256.Sum256(rawBody)
	canonical := ts + "." + nonce + "." + r.Method + "." + path + "." + hex.EncodeToString(bodyHash[:])
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(canonical))
	expected := hex.EncodeToString(mac.Sum(nil))
	return subtle.ConstantTimeCompare([]byte(sig), []byte(expected)) == 1
}