Go webhook signature verifier

python3 make-test.py events/test-ping.json private/request-1

go build -o verify-go verify.go
./verify-go private/request-1/body.json private/request-1/headers.json

// Notification authenticity, not license validity. Go 1.24+, standard library.
// Build: go build -o verify-go verify.go; run from this folder with the two KDP_WEBHOOK environment variables.
// Run: ./verify-go body.json headers.json; expected verified=true JSON or verified=false / exit 1.
package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "errors"
    "fmt"
    "io"
    "os"
    "regexp"
    "strconv"
    "strings"
    "time"
    "unicode/utf8"
)

type Contract struct {
    Events []string `json:"events"`
    Environments []string `json:"environments"`
    BodyLimit int64 `json:"body_limit"`
    Tolerance int64 `json:"tolerance_seconds"`
}
type Event struct {
    ID string `json:"id"`
    Name string `json:"event"`
    Environment string `json:"environment"`
    CreatedAt string `json:"created_at"`
    Data map[string]json.RawMessage `json:"data"`
}
func bounded(path string, limit int64) ([]byte, error) {
    file, err := os.Open(path); if err != nil { return nil, err }; defer file.Close()
    value, err := io.ReadAll(io.LimitReader(file, limit+1))
    if err != nil || int64(len(value)) > limit { return nil, errors.New("input unavailable or oversized") }
    return value, nil
}
func contains(values []string, candidate string) bool {
    for _, value := range values { if value == candidate { return true } }; return false
}
func verify(body []byte, headers map[string]string, secret, environment string, now int64, c Contract) (Event, error) {
    var event Event
    fail := errors.New("verification failed")
    if secret == "" || !contains(c.Environments, environment) || int64(len(body)) > c.BodyLimit { return event, fail }
    parts := regexp.MustCompile(`^t=([1-9][0-9]{0,10}),v1=([0-9a-f]{64})$`).FindStringSubmatch(headers["x-lmp-signature"])
    if parts == nil { return event, fail }
    stamp, err := strconv.ParseInt(parts[1],10,64); if err != nil || stamp < now-c.Tolerance || stamp > now+c.Tolerance { return event, fail }
    mac := hmac.New(sha256.New, []byte(secret)); mac.Write([]byte(parts[1]+".")); mac.Write(body)
    supplied, err := hex.DecodeString(parts[2]); if err != nil || !hmac.Equal(mac.Sum(nil),supplied) { return event, fail }
    if !utf8.Valid(body) || json.Unmarshal(body, &event) != nil { return event, fail }
    if !regexp.MustCompile(`^evt_[A-Za-z0-9_-]{1,100}$`).MatchString(event.ID) || !contains(c.Events,event.Name) || event.Environment != environment || event.ID != headers["x-lmp-event-id"] || event.Name != headers["x-lmp-event"] || event.Data == nil || event.CreatedAt == "" { return event, fail }
    return event, nil
}
func run() error {
    if len(os.Args) != 3 { return errors.New("two file paths required") }
    raw, err := bounded("contract.json",32768); if err != nil { return err }; var c Contract
    if json.Unmarshal(raw,&c) != nil || c.BodyLimit != 1048576 || c.Tolerance != 300 { return errors.New("invalid contract") }
    body, err := bounded(os.Args[1],c.BodyLimit); if err != nil { return err }
    rawHeaders, err := bounded(os.Args[2],32768); if err != nil { return err }; var headers map[string]string
    if json.Unmarshal(rawHeaders,&headers) != nil { return errors.New("invalid headers") }
    event, err := verify(body,headers,os.Getenv("KDP_WEBHOOK_SECRET"),strings.ToLower(os.Getenv("KDP_WEBHOOK_ENVIRONMENT")),time.Now().Unix(),c)
    if err != nil { return err }
    result := map[string]any{"verified":true,"event_id":event.ID,"event":event.Name,"environment":event.Environment}
    output, err := json.Marshal(result); if err != nil { return err }; fmt.Println(string(output)); return nil
}
func main() {
    if run() != nil { fmt.Println(`{"verified":false}`); os.Exit(1) }
}