LeadShield REST API

curl -X POST https://lead-shield.ru/api/v1/verify/init \
  -H 'Content-Type: application/json' \
  -d '{
    "site_key": "ls_pk_abc123",
    "phone": "+79123456789"
  }'
# 200 { "session_id": "...", "status": "code_sent", "channel": "flash_call" }

curl -X POST https://lead-shield.ru/api/v1/verify/resend \
  -H 'Content-Type: application/json' \
  -d '{ "session_id": "SESSION_ID", "channel": "sms" }'

curl -X POST https://lead-shield.ru/api/v1/verify/check \
  -H 'Content-Type: application/json' \
  -d '{ "session_id": "SESSION_ID", "code": "1234" }'
# 200 { "verified": true, "token": "..." } — либо { "verified": false, "attempts_left": 2 }

import hashlib, hmac, time

SECRET = b'ls_sk_0123456789abcdef0123456789abcdef'  # site_secret из кабинета
MAX_SKEW_SEC = 300

def verify_signature(headers: dict, raw_body: bytes) -> bool:
    ts = headers.get('X-LeadShield-Timestamp')
    received = headers.get('X-LeadShield-Signature', '')
    if not received.startswith('sha256='):
        return False
    if ts is not None:
        # Актуальный формат: подпись от "{ts}.{body}", свежесть ±300 сек
        if abs(time.time() - int(ts)) > MAX_SKEW_SEC:
            return False
        signed = f'{ts}.'.encode() + raw_body
    else:
        # Legacy-формат (переходный период): подпись от чистого тела.
        # Принимаем, но логируем deprecation-warning.
        signed = raw_body
    expected = hmac.new(SECRET, signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, received.removeprefix('sha256='))

# Flask: raw_body = request.get_data()

const crypto = require('crypto');

const SECRET = 'ls_sk_0123456789abcdef0123456789abcdef'; // site_secret из кабинета
const MAX_SKEW_SEC = 300;

// rawBody — тело запроса байт-в-байт (express.raw({ type: 'application/json' }))
function verifySignature(headers, rawBody) {
  const ts = headers['x-leadshield-timestamp'];
  const received = headers['x-leadshield-signature'] || '';
  if (!received.startsWith('sha256=')) return false;
  let signed;
  if (ts !== undefined) {
    // Актуальный формат: "{ts}.{body}", свежесть ±300 сек
    if (Math.abs(Math.floor(Date.now() / 1000) - Number(ts)) > MAX_SKEW_SEC) return false;
    signed = Buffer.concat([Buffer.from(`${ts}.`), rawBody]);
  } else {
    // Legacy-формат (переходный период): подпись от чистого тела + deprecation-warning в лог
    console.warn('[leadshield-webhook] legacy signature format used — update verifier');
    signed = rawBody;
  }
  const expected = crypto.createHmac('sha256', SECRET).update(signed).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received.slice(7)));
}