Decrypt Webhook Payload

// OZZOBiTWebhookDecryptor.java
import javax.crypto.Cipher;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.util.Base64;

public class OZZOBiTWebhookDecryptor {

    private static final String ALGORITHM = "AES/GCM/NoPadding";
    private static final int GCM_IV_LENGTH = 12;
    private static final int GCM_TAG_LENGTH = 128;

    public static String decrypt(String encryptedPayload, String webhookSecret) throws Exception {
        byte[] decoded = Base64.getDecoder().decode(encryptedPayload);
        
        // Extract IV (first 12 bytes)
        byte[] iv = new byte[GCM_IV_LENGTH];
        System.arraycopy(decoded, 0, iv, 0, GCM_IV_LENGTH);
        
        // Prepare key (pad or truncate to 32 bytes for AES-256)
        byte[] keyBytes = Arrays.copyOf(
            webhookSecret.getBytes(StandardCharsets.UTF_8), 
            32
        );
        
        // Initialize cipher
        SecretKeySpec keySpec = new SecretKeySpec(keyBytes, "AES");
        GCMParameterSpec gcmSpec = new GCMParameterSpec(GCM_TAG_LENGTH, iv);
        
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        cipher.init(Cipher.DECRYPT_MODE, keySpec, gcmSpec);
        
        // Decrypt (remaining bytes after IV)
        byte[] ciphertext = Arrays.copyOfRange(decoded, GCM_IV_LENGTH, decoded.length);
        byte[] decrypted = cipher.doFinal(ciphertext);
        
        return new String(decrypted, StandardCharsets.UTF_8);
    }

    public static boolean verifySignature(
        String payload, 
        String receivedSignature, 
        String webhookSecret
    ) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA256");
        SecretKeySpec keySpec = new SecretKeySpec(
            webhookSecret.getBytes(StandardCharsets.UTF_8), 
            "HmacSHA256"
        );
        mac.init(keySpec);
        byte[] expectedHash = mac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
        String expectedSig = Base64.getEncoder().encodeToString(expectedHash);
        
        return MessageDigest.isEqual(
            expectedSig.getBytes(StandardCharsets.UTF_8),
            receivedSignature.getBytes(StandardCharsets.UTF_8)
        );
    }
}

// Spring Boot Controller example:
@RestController
@RequestMapping("/api/webhooks")
public class OZZOBiTWebhookController {

    @Value("${OZZOBiT.webhook.secret}")
    private String webhookSecret;

    @PostMapping("/OZZOBiT")
    public ResponseEntity<?> handleWebhook(
        @RequestBody String payload,
        @RequestHeader("X-OZZOBiT-Signature") String signature
    ) {
        try {
            // Verify signature
            if (!OZZOBiTWebhookDecryptor.verifySignature(payload, signature, webhookSecret)) {
                return ResponseEntity.status(401).body("Invalid signature");
            }
            
            // Decrypt payload
            String decrypted = OZZOBiTWebhookDecryptor.decrypt(payload, webhookSecret);
            JsonObject event = JsonParser.parseString(decrypted).getAsJsonObject();
            
            String eventName = event.get("eventName").getAsString();
            
            switch (eventName) {
                case "ORDER_COMPLETED":
                    handleOrderCompleted(event.getAsJsonObject("data"));
                    break;
                case "ORDER_FAILED":
                    handleOrderFailed(event.getAsJsonObject("data"));
                    break;
            }
            
            return ResponseEntity.ok(Map.of("success", true));
            
        } catch (Exception e) {
            log.error("Webhook processing error", e);
            return ResponseEntity.status(500).body("Processing error");
        }
    }
}

// OZZOBiT_webhook.go
package main

import (
    "crypto/aes"
    "crypto/cipher"
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "encoding/json"
    "errors"
    "io"
)

const (
    algorithm     = "aes-256-gcm"
    ivLength      = 12
    tagLength     = 16
)

type WebhookEvent struct {
    EventName string                 `json:"eventName"`
    Data      map[string]interface{} `json:"data"`
    Timestamp string                 `json:"timestamp"`
}

func DecryptWebhookPayload(encryptedPayload, webhookSecret string) (*WebhookEvent, error) {
    // Decode base64
    ciphertext, err := base64.StdEncoding.DecodeString(encryptedPayload)
    if err != nil {
        return nil, err
    }
    
    // Extract IV (first 12 bytes)
    if len(ciphertext) < ivLength+tagLength {
        return nil, errors.New("payload too short")
    }
    
    iv := ciphertext[:ivLength]
    tag := ciphertext[ivLength : ivLength+tagLength]
    encData := ciphertext[ivLength+tagLength:]
    
    // Prepare key
    key := []byte(webhookSecret)
    if len(key) > 32 {
        key = key[:32]
    }
    for len(key) < 32 {
        key = append(key, 0)
    }
    
    // Create block cipher
    block, err := aes.NewCipher(key)
    if err != nil {
        return nil, err
    }
    
    // Create GCM mode with tag appended
    gcm, err := cipher.NewGCMWithTagSize(block, tagLength*8)
    if err != nil {
        return nil, err
    }
    
    // Decrypt (ciphertext includes tag)
    plaintext, err := gcm.Open(nil, iv, append(encData, tag...), nil)
    if err != nil {
        return nil, err
    }
    
    var event WebhookEvent
    if err := json.Unmarshal(plaintext, &event); err != nil {
        return nil, err
    }
    
    return &event, nil
}

func VerifyWebhookSignature(payload, signature, webhookSecret string) bool {
    mac := hmac.New(sha256.New, []byte(webhookSecret))
    io.WriteString(mac, payload)
    expectedSig := base64.StdEncoding.EncodeToString(mac.Sum(nil))
    
    return hmac.Equal([]byte(signature), []byte(expectedSig))
}

// HTTP handler example (using net/http):
func OZZOBiTWebhookHandler(w http.ResponseWriter, r *http.Request) {
    // Read body
    body, _ := io.ReadAll(r.Body)
    defer r.Body.Close()
    
    signature := r.Header.Get("X-OZZOBiT-Signature")
    
    // Verify signature
    if !VerifyWebhookSignature(string(body), signature, webhookSecret) {
        w.WriteHeader(http.StatusUnauthorized)
        w.Write([]byte("Invalid signature"))
        return
    }
    
    // Decrypt
    event, err := DecryptWebhookPayload(string(body), webhookSecret)
    if err != nil {
        w.WriteHeader(http.StatusBadRequest)
        w.Write([]byte("Decryption failed"))
        return
    }
    
    // Handle event
    switch event.EventName {
    case "ORDER_COMPLETED":
        handleOrderCompleted(event.Data)
    case "ORDER_FAILED":
        handleOrderFailed(event.Data)
    }
    
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(map[string]bool{"success": true})
}