const crypto = require('crypto');

app.post('/payzor/webhook',
  express.raw({ type: '*/*' }),            // el cuerpo crudo es imprescindible
  (req, res) => {
    const sig = req.get('X-Payzor-Signature') || '';
    const [tPart, v1Part] = sig.split(',');
    const t = tPart.slice(2);                // "t=1690..."
    const v1 = v1Part.slice(3);              // "v1=abc..."

    const expected = crypto
      .createHmac('sha256', process.env.PAYZOR_WEBHOOK_SECRET)
      .update(`${t}.${req.body.toString()}`)
      .digest('hex');

    const ok = crypto.timingSafeEqual(
      Buffer.from(v1), Buffer.from(expected)
    );
    if (!ok) return res.status(401).end();

    const event = JSON.parse(req.body.toString());
    // ... maneja event.type
    res.json({ ok: true });
  });

import hmac, hashlib

@app.post("/payzor/webhook")
async def payzor_webhook(request: Request):
    raw = await request.body()
    sig = request.headers["x-payzor-signature"]
    t_part, v1_part = sig.split(",")
    t = t_part[2:]          # después de "t="
    v1 = v1_part[3:]        # después de "v1="

    expected = hmac.new(
        PAYZOR_WEBHOOK_SECRET.encode(),
        f"{t}.".encode() + raw,
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(v1, expected):
        raise HTTPException(status_code=401)

    event = json.loads(raw)
    # ... maneja event["type"]