Data Connectors

import hashlib, hmac, time

def verify_helpr_signature(request, secret: str) -> bool:
    timestamp = request.headers.get('X-Helpr-Timestamp', '')
    signature = request.headers.get('X-Helpr-Signature', '')

    if (not timestamp or len(timestamp) > 12
            or not timestamp.isascii() or not timestamp.isdecimal()
            or timestamp[0] == '0' or len(signature) != 71
            or not signature.startswith('sha256=')
            or any(c not in '0123456789abcdef' for c in signature[7:])):
        return False
    if abs(int(time.time()) - int(timestamp)) > 300:
        return False

    body = request.get_data(cache=True)  # bytes; do not decode or re-serialize
    signed_payload = timestamp.encode('ascii') + b'.' + body
    expected = 'sha256=' + hmac.new(
        secret.encode(), signed_payload, hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(signature, expected)

function verifyHelprSignature(string $secret): bool {
    $timestamp = $_SERVER['HTTP_X_HELPR_TIMESTAMP'] ?? '';
    $signature = $_SERVER['HTTP_X_HELPR_SIGNATURE'] ?? '';

    if (!preg_match('/^[1-9][0-9]*$/D', $timestamp)
        || !preg_match('/^sha256=[a-f0-9]{64}$/D', $signature)
        || abs(time() - (int) $timestamp) > 300) return false;

    $body = file_get_contents('php://input');
    if ($body === false) return false;
    $expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $body, $secret);

    return hash_equals($expected, $signature);
}

require 'openssl'

def verify_helpr_signature(request, secret)
  timestamp = request.headers['X-Helpr-Timestamp']
  signature = request.headers['X-Helpr-Signature']

  return false unless timestamp&.match?(/\A[1-9][0-9]*\z/)
  return false unless signature&.match?(/\Asha256=[a-f0-9]{64}\z/)
  return false if (Time.now.to_i - timestamp.to_i).abs > 300

  request.body.rewind
  body = request.body.read
  request.body.rewind
  signed_payload = timestamp.b + '.'.b + body.b
  expected = 'sha256=' + OpenSSL::HMAC.hexdigest('SHA256', secret, signed_payload)

  Rack::Utils.secure_compare(expected, signature)
end

package main

import (
    "bytes"
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "io"
    "net/http"
    "strconv"
    "strings"
    "time"
)

func verifyHelprSignature(r *http.Request, secret string) bool {
    timestamp := r.Header.Get("X-Helpr-Timestamp")
    signature := r.Header.Get("X-Helpr-Signature")
    if timestamp == "" || timestamp[0] == '0' ||
        strings.Trim(timestamp, "0123456789") != "" ||
        len(signature) != 71 || !strings.HasPrefix(signature, "sha256=") ||
        strings.Trim(signature[7:], "0123456789abcdef") != "" {
        return false
    }

    ts, err := strconv.ParseInt(timestamp, 10, 64)
    now := time.Now().Unix()
    if err != nil || ts <= 0 || ts < now-300 || ts > now+300 {
        return false
    }

    body, err := io.ReadAll(r.Body)
    if err != nil {
        return false
    }
    r.Body = io.NopCloser(bytes.NewReader(body)) // Preserve bytes for JSON decoding.

    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(timestamp + "."))
    mac.Write(body)

    provided, err := hex.DecodeString(strings.TrimPrefix(signature, "sha256="))
    return err == nil && len(provided) == sha256.Size && hmac.Equal(provided, mac.Sum(nil))
}

import hashlib, hmac, json, os, time
from flask import Flask, request, jsonify

app = Flask(__name__)
HELPR_SECRET = os.environ['HELPR_DATA_CONNECTOR_SECRET']

def verify_helpr(f):
    def wrapper(*args, **kwargs):
        timestamp = request.headers.get('X-Helpr-Timestamp', '')
        signature = request.headers.get('X-Helpr-Signature', '')

        if (not timestamp or len(timestamp) > 12
                or not timestamp.isascii() or not timestamp.isdecimal()
                or timestamp[0] == '0' or len(signature) != 71
                or not signature.startswith('sha256=')
                or any(c not in '0123456789abcdef' for c in signature[7:])):
            return jsonify(error='Missing or malformed signature'), 401
        if abs(int(time.time()) - int(timestamp)) > 300:
            return jsonify(error='Request too old'), 401

        body = request.get_data(cache=True)
        signed_payload = timestamp.encode('ascii') + b'.' + body
        expected = 'sha256=' + hmac.new(
            HELPR_SECRET.encode(), signed_payload, hashlib.sha256
        ).hexdigest()

        if not hmac.compare_digest(signature, expected):
            return jsonify(error='Invalid signature'), 401

        return f(*args, **kwargs)
    wrapper.__name__ = f.__name__
    return wrapper

@app.route('/helpr/order-lookup', methods=['POST'])
@verify_helpr
def order_lookup():
    data = request.json
    order_number = data.get('order_number')
    identity = data.get('helpr_identity')
    challenge_resp = data.get('helpr_challenge_response')

    order = db.orders.find_one({'order_number': order_number})
    if not order:
        return jsonify(error='Order not found'), 404

    if not identity:
        return jsonify(error='Identity required'), 401

    # Challenge if no verification yet
    if not challenge_resp:
        return jsonify(helpr_challenge=[{
            'field': 'shipping_zip',
            'prompt': 'What is the shipping zip code for this order?'
        }])

    # Validate the answer
    if challenge_resp.get('shipping_zip') != order['shipping_zip']:
        return jsonify(error='Zip code does not match'), 403

    return jsonify(
        order_id=order['order_number'],
        status=order['status'],
        tracking_number=order.get('tracking_number'),
        estimated_delivery=order.get('estimated_delivery'),
        total=f"${order['total']:.2f}"
    )

<?php
$secret = $_ENV['HELPR_DATA_CONNECTOR_SECRET'];

// Verify signature
$timestamp = $_SERVER['HTTP_X_HELPR_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_HELPR_SIGNATURE'] ?? '';

if (!preg_match('/^[1-9][0-9]*$/D', $timestamp)
    || !preg_match('/^sha256=[a-f0-9]{64}$/D', $signature)) {
    http_response_code(401);
    echo json_encode(['error' => 'Missing or malformed signature']);
    exit;
}
if (abs(time() - (int) $timestamp) > 300) {
    http_response_code(401);
    echo json_encode(['error' => 'Request too old']);
    exit;
}

$rawBody = file_get_contents('php://input');
if ($rawBody === false) {
    http_response_code(400);
    echo json_encode(['error' => 'Could not read request body']);
    exit;
}
$expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

$data = json_decode($rawBody, true);
$orderNumber = $data['order_number'] ?? '';
$identity = $data['helpr_identity'] ?? null;
$challengeResp = $data['helpr_challenge_response'] ?? null;

$order = $db->orders->findOne(['order_number' => $orderNumber]);
if (!$order) {
    http_response_code(404);
    echo json_encode(['error' => 'Order not found']);
    exit;
}

if (!$identity) {
    http_response_code(401);
    echo json_encode(['error' => 'Identity required']);
    exit;
}

// Challenge if no verification yet
if (!$challengeResp) {
    echo json_encode(['helpr_challenge' => [[
        'field' => 'shipping_zip',
        'prompt' => 'What is the shipping zip code for this order?',
    ]]]);
    exit;
}

// Validate the answer
if (($challengeResp['shipping_zip'] ?? '') !== $order['shipping_zip']) {
    http_response_code(403);
    echo json_encode(['error' => 'Zip code does not match']);
    exit;
}

echo json_encode([
    'order_id' => $order['order_number'],
    'status' => $order['status'],
    'tracking_number' => $order['tracking_number'] ?? null,
    'estimated_delivery' => $order['estimated_delivery'] ?? null,
    'total' => '$' . number_format($order['total'], 2),
]);

require 'sinatra'
require 'json'
require 'openssl'

HELPR_SECRET = ENV['HELPR_DATA_CONNECTOR_SECRET']

before '/helpr/*' do
  request.body.rewind
  @raw_body = request.body.read
  timestamp = request.env['HTTP_X_HELPR_TIMESTAMP']
  signature = request.env['HTTP_X_HELPR_SIGNATURE']

  unless timestamp&.match?(/\A[1-9][0-9]*\z/) &&
         signature&.match?(/\Asha256=[a-f0-9]{64}\z/)
    halt 401, { error: 'Missing or malformed signature' }.to_json
  end
  if (Time.now.to_i - timestamp.to_i).abs > 300
    halt 401, { error: 'Request too old' }.to_json
  end

  signed_payload = timestamp.b + '.'.b + @raw_body.b
  expected = 'sha256=' + OpenSSL::HMAC.hexdigest('SHA256', HELPR_SECRET, signed_payload)

  unless Rack::Utils.secure_compare(expected, signature)
    halt 401, { error: 'Invalid signature' }.to_json
  end

  @data = JSON.parse(@raw_body)
end

post '/helpr/order-lookup' do
  content_type :json
  order = DB[:orders].where(order_number: @data['order_number']).first
  halt 404, { error: 'Order not found' }.to_json unless order

  identity = @data['helpr_identity']
  halt 401, { error: 'Identity required' }.to_json unless identity

  challenge_resp = @data['helpr_challenge_response']

  # Challenge if no verification yet
  unless challenge_resp
    return { helpr_challenge: [{
      field: 'shipping_zip',
      prompt: 'What is the shipping zip code for this order?'
    }] }.to_json
  end

  # Validate the answer
  if challenge_resp['shipping_zip'] != order[:shipping_zip]
    halt 403, { error: 'Zip code does not match' }.to_json
  end

  {
    order_id: order[:order_number],
    status: order[:status],
    tracking_number: order[:tracking_number],
    estimated_delivery: order[:estimated_delivery],
    total: "$#{'%.2f' % order[:total]}"
  }.to_json
end