Real-time events for your hotel stack

import crypto from "node:crypto";

export function verifySwiftGuestSignature(
  rawBody: string,
  headerValue: string,
  secret: string,
): boolean {
  // Header looks like: "t=1744572300,v1=9a2e4b..."
  const parts = Object.fromEntries(
    headerValue.split(",").map((kv) => kv.split("=") as [string, string]),
  );

  const timestamp = parts.t;
  const signature = parts.v1;

  if (!timestamp || !signature) return false;

  // Reject anything older than 5 minutes to prevent replay
  const age = Math.floor(Date.now() / 1000) - Number(timestamp);
  if (age > 300) return false;

  const signedPayload = `${timestamp}.${rawBody}`;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(signedPayload)
    .digest("hex");

  // Use timingSafeEqual to avoid timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(signature, "hex"),
  );
}

// Express handler
app.post(
  "/webhooks/swiftguest",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const valid = verifySwiftGuestSignature(
      req.body.toString("utf8"),
      req.header("SwiftGuest-Signature") ?? "",
      process.env.SWIFTGUEST_WEBHOOK_SECRET!,
    );

    if (!valid) return res.status(401).send("invalid signature");

    const event = JSON.parse(req.body.toString("utf8"));
    // Enqueue and ack immediately — never do heavy work in the handler
    queue.enqueue(event);

    res.status(200).send("ok");
  },
);

import hmac
import hashlib
import time


def verify_swiftguest_signature(
    raw_body: bytes,
    header_value: str,
    secret: str,
) -> bool:
    # Header: "t=1744572300,v1=9a2e4b..."
    parts = dict(item.split("=", 1) for item in header_value.split(","))
    timestamp = parts.get("t")
    signature = parts.get("v1")

    if not timestamp or not signature:
        return False

    # Reject if older than 5 minutes
    if int(time.time()) - int(timestamp) > 300:
        return False

    signed_payload = f"{timestamp}.{raw_body.decode('utf-8')}".encode()
    expected = hmac.new(
        secret.encode(),
        signed_payload,
        hashlib.sha256,
    ).hexdigest()

    return hmac.compare_digest(expected, signature)


# Flask handler
@app.post("/webhooks/swiftguest")
def handle_webhook():
    raw = request.get_data()
    header = request.headers.get("SwiftGuest-Signature", "")

    if not verify_swiftguest_signature(raw, header, SECRET):
        abort(401)

    event = request.get_json()
    enqueue(event)  # Ack quickly, do the work async
    return "", 200