Data Connectors

import hashlib, hmac, time

def verify_helpr_signature(request, secret: str) -> bool:
    timestamp = request.headers.get('X-Helpr-Timestamp', '')
    signature = request.headers.get('X-Helpr-Signature', '')

    if abs(time.time() - int(timestamp)) > 300:
        return False

    body = request.get_data(as_text=True)
    path = request.path
    body_hash = hashlib.sha256(body.encode()).hexdigest()
    canonical = f"POST\n{path}\n{timestamp}\n{body_hash}"
    expected = 'sha256=' + hmac.new(
        secret.encode(), canonical.encode(), hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(signature, expected)

function verifyHelprSignature(string $secret): bool {
    $timestamp = $_SERVER['HTTP_X_HELPR_TIMESTAMP'] ?? '';
    $signature = $_SERVER['HTTP_X_HELPR_SIGNATURE'] ?? '';

    if (abs(time() - (int) $timestamp) > 300) return false;

    $body = file_get_contents('php://input');
    $path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
    $canonical = "POST\n{$path}\n{$timestamp}\n" . hash('sha256', $body);
    $expected = 'sha256=' . hash_hmac('sha256', $canonical, $secret);

    return hash_equals($expected, $signature);
}

require 'openssl'

def verify_helpr_signature(request, secret)
  timestamp = request.headers['X-Helpr-Timestamp']
  signature = request.headers['X-Helpr-Signature']

  return false if (Time.now.to_i - timestamp.to_i).abs > 300

  body = request.body.read
  path = request.path
  body_hash = OpenSSL::Digest::SHA256.hexdigest(body)
  canonical = "POST\n#{path}\n#{timestamp}\n#{body_hash}"
  expected = 'sha256=' + OpenSSL::HMAC.hexdigest('SHA256', secret, canonical)

  Rack::Utils.secure_compare(expected, signature)
end

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "math"
    "net/http"
    "strconv"
    "time"
)

func verifyHelprSignature(r *http.Request, secret string) bool {
    timestamp := r.Header.Get("X-Helpr-Timestamp")
    signature := r.Header.Get("X-Helpr-Signature")

    ts, err := strconv.ParseInt(timestamp, 10, 64)
    if err != nil || math.Abs(float64(time.Now().Unix()-ts)) > 300 {
        return false
    }

    bodyHash := sha256.Sum256(body)
    canonical := fmt.Sprintf("POST\n%s\n%s\n%x", r.URL.Path, timestamp, bodyHash)

    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(canonical))
    expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))

    return hmac.Equal([]byte(signature), []byte(expected))
}

import hashlib, hmac, json, time
from flask import Flask, request, jsonify

app = Flask(__name__)
HELPR_SECRET = os.environ['HELPR_WEBHOOK_SECRET']

def verify_helpr(f):
    def wrapper(*args, **kwargs):
        timestamp = request.headers.get('X-Helpr-Timestamp', '')
        signature = request.headers.get('X-Helpr-Signature', '')

        if abs(time.time() - int(timestamp)) > 300:
            return jsonify(error='Request too old'), 401

        body = request.get_data(as_text=True)
        body_hash = hashlib.sha256(body.encode()).hexdigest()
        canonical = f"POST\n{request.path}\n{timestamp}\n{body_hash}"
        expected = 'sha256=' + hmac.new(
            HELPR_SECRET.encode(), canonical.encode(), hashlib.sha256
        ).hexdigest()

        if not hmac.compare_digest(signature, expected):
            return jsonify(error='Invalid signature'), 401

        return f(*args, **kwargs)
    wrapper.__name__ = f.__name__
    return wrapper

@app.route('/helpr/order-lookup', methods=['POST'])
@verify_helpr
def order_lookup():
    data = request.json
    order_number = data.get('order_number')
    identity = data.get('helpr_identity')
    challenge_resp = data.get('helpr_challenge_response')

    order = db.orders.find_one({'order_number': order_number})
    if not order:
        return jsonify(error='Order not found'), 404

    if not identity:
        return jsonify(error='Identity required'), 401

    # Challenge if no verification yet
    if not challenge_resp:
        return jsonify(helpr_challenge=[{
            'field': 'shipping_zip',
            'prompt': 'What is the shipping zip code for this order?'
        }])

    # Validate the answer
    if challenge_resp.get('shipping_zip') != order['shipping_zip']:
        return jsonify(error='Zip code does not match'), 403

    return jsonify(
        order_id=order['order_number'],
        status=order['status'],
        tracking_number=order.get('tracking_number'),
        estimated_delivery=order.get('estimated_delivery'),
        total=f"${order['total']:.2f}"
    )

<?php
$secret = $_ENV['HELPR_WEBHOOK_SECRET'];

// Verify signature
$timestamp = $_SERVER['HTTP_X_HELPR_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_HELPR_SIGNATURE'] ?? '';

if (abs(time() - (int) $timestamp) > 300) {
    http_response_code(401);
    echo json_encode(['error' => 'Request too old']);
    exit;
}

$rawBody = file_get_contents('php://input');
$path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
$canonical = "POST\n{$path}\n{$timestamp}\n" . hash('sha256', $rawBody);
$expected = 'sha256=' . hash_hmac('sha256', $canonical, $secret);

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

$data = json_decode($rawBody, true);
$orderNumber = $data['order_number'] ?? '';
$identity = $data['helpr_identity'] ?? null;
$challengeResp = $data['helpr_challenge_response'] ?? null;

$order = $db->orders->findOne(['order_number' => $orderNumber]);
if (!$order) {
    http_response_code(404);
    echo json_encode(['error' => 'Order not found']);
    exit;
}

if (!$identity) {
    http_response_code(401);
    echo json_encode(['error' => 'Identity required']);
    exit;
}

// Challenge if no verification yet
if (!$challengeResp) {
    echo json_encode(['helpr_challenge' => [[
        'field' => 'shipping_zip',
        'prompt' => 'What is the shipping zip code for this order?',
    ]]]);
    exit;
}

// Validate the answer
if (($challengeResp['shipping_zip'] ?? '') !== $order['shipping_zip']) {
    http_response_code(403);
    echo json_encode(['error' => 'Zip code does not match']);
    exit;
}

echo json_encode([
    'order_id' => $order['order_number'],
    'status' => $order['status'],
    'tracking_number' => $order['tracking_number'] ?? null,
    'estimated_delivery' => $order['estimated_delivery'] ?? null,
    'total' => '$' . number_format($order['total'], 2),
]);

require 'sinatra'
require 'json'
require 'openssl'

HELPR_SECRET = ENV['HELPR_WEBHOOK_SECRET']

before '/helpr/*' do
  request.body.rewind
  @raw_body = request.body.read
  timestamp = request.env['HTTP_X_HELPR_TIMESTAMP']
  signature = request.env['HTTP_X_HELPR_SIGNATURE']

  if (Time.now.to_i - timestamp.to_i).abs > 300
    halt 401, { error: 'Request too old' }.to_json
  end

  body_hash = OpenSSL::Digest::SHA256.hexdigest(@raw_body)
  canonical = "POST\n#{request.path}\n#{timestamp}\n#{body_hash}"
  expected = 'sha256=' + OpenSSL::HMAC.hexdigest('SHA256', HELPR_SECRET, canonical)

  unless Rack::Utils.secure_compare(expected, signature)
    halt 401, { error: 'Invalid signature' }.to_json
  end

  @data = JSON.parse(@raw_body)
end

post '/helpr/order-lookup' do
  content_type :json
  order = DB[:orders].where(order_number: @data['order_number']).first
  halt 404, { error: 'Order not found' }.to_json unless order

  identity = @data['helpr_identity']
  halt 401, { error: 'Identity required' }.to_json unless identity

  challenge_resp = @data['helpr_challenge_response']

  # Challenge if no verification yet
  unless challenge_resp
    return { helpr_challenge: [{
      field: 'shipping_zip',
      prompt: 'What is the shipping zip code for this order?'
    }] }.to_json
  end

  # Validate the answer
  if challenge_resp['shipping_zip'] != order[:shipping_zip]
    halt 403, { error: 'Zip code does not match' }.to_json
  end

  {
    order_id: order[:order_number],
    status: order[:status],
    tracking_number: order[:tracking_number],
    estimated_delivery: order[:estimated_delivery],
    total: "$#{'%.2f' % order[:total]}"
  }.to_json
end