Contrato do operador

import crypto from 'node:crypto'
import express from 'express'

const app = express()
const CLIENT_SECRET = process.env.DV_CLIENT_SECRET

// Guarda o corpo como Buffer, sem parse, em todas as rotas do contrato
app.use('/v1/loyalty', express.raw({ type: '*/*' }))

function verifySignature(req, res, next) {
  // Sem corpo (ping, reversal), o Express não entrega um Buffer: assine a string vazia
  const raw = Buffer.isBuffer(req.body) ? req.body : Buffer.alloc(0)
  const expected = crypto.createHmac('sha256', CLIENT_SECRET).update(raw).digest('hex')
  const received = req.get('X-App-Signature') ?? ''

  const valid =
    received.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received))
  if (!valid) return res.status(401).end()

  req.json = raw.length > 0 ? JSON.parse(raw) : null // parse só depois de validar
  next()
}

app.get('/v1/loyalty/ping', verifySignature, (req, res) => res.status(204).end())

app.listen(4001)

import hashlib
import hmac
import os

from flask import Flask, abort, request

app = Flask(__name__)
CLIENT_SECRET = os.environ["DV_CLIENT_SECRET"].encode()


def verify_signature():
    raw = request.get_data()  # bytes exatamente como chegaram; b"" sem corpo
    expected = hmac.new(CLIENT_SECRET, raw, hashlib.sha256).hexdigest()
    received = request.headers.get("X-App-Signature", "")
    if not hmac.compare_digest(expected, received):
        abort(401)


@app.get("/v1/loyalty/ping")
def ping():
    verify_signature()
    return "", 204

expected = OpenSSL::HMAC.hexdigest("SHA256", client_secret, request.raw_post)
valid = ActiveSupport::SecurityUtils.secure_compare(expected, request.headers["X-App-Signature"].to_s)
head :unauthorized unless valid