Подпись оповещений (HMAC)

def parse_json(prefix, obj, result):
    """
    Рекурсивный обход JSON-структуры для формирования пар путь:значение.
    """
    if isinstance(obj, dict):
        for key, value in obj.items():
            if isinstance(key, bool):
                key = int(key)
            new_prefix = f"{prefix}:{key}" if prefix else str(key)
            parse_json(new_prefix, value, result)
    elif isinstance(obj, list):
        for index, item in enumerate(obj):
            if isinstance(item, bool):
                item = int(item)
            new_prefix = f"{prefix}:{index}"
            parse_json(new_prefix, item, result)
    else:
        if isinstance(obj, bool):
            obj = int(obj)
        if obj is None:
            obj = ""
        result.append(f"{prefix}:{obj}")


def normalize_message(payload: dict) -> str:
    """
    Нормализация JSON в детерминированную строку (формат: путь:значение через ;).
    """
    items: list[str] = []
    parse_json("", payload, items)
    items.sort()
    return ";".join(items)

import base64
import binascii
import hmac
import hashlib


def masked_hmac_key(key: str) -> str:
    if not key or len(key) <= 6:
        return "*******"
    return key[:3] + "*******" + key[-3:]


def base64url_decode(data: str) -> bytes:
    normalized = str(data).strip().replace("-", "+").replace("_", "/")
    if not normalized:
        raise ValueError("Invalid base64url string")
    padding = "=" * (-len(normalized) % 4)
    try:
        return base64.b64decode(f"{normalized}{padding}", validate=True)
    except binascii.Error as exc:
        raise ValueError("Invalid base64url string") from exc


def verify_hmac_callback_signature(
    payload: dict,
    signature_b64url: str,
    access_token: str,
    secret_key: str,
    timestamp: str,
) -> bool:
    """
    Проверить подпись оповещения по алгоритму HMAC-SHA512.
    """
    # Проверка маски ключа (x-access-token)
    expected_mask = masked_hmac_key(secret_key)
    if not hmac.compare_digest(expected_mask, access_token):
        raise ValueError("Invalid x-access-token mask")

    # Нормализация и подготовка сообщения
    normalized = normalize_message(payload)
    encoded = base64.urlsafe_b64encode(normalized.encode("utf-8")).decode("utf-8")
    message = f"{encoded}{timestamp}".encode("utf-8")

    # Вычисление ожидаемой подписи
    expected_signature = hmac.new(secret_key.encode("utf-8"), message, hashlib.sha512).digest()
    received_signature = base64url_decode(signature_b64url)

    # Сравнение подписи, устойчивое к тайминговым атакам
    return hmac.compare_digest(expected_signature, received_signature)

{"general":{"project_id":"test-project-123"},"payment":{"amount":100000,"currency":"USD"}}