Webhooks de integración

export TERO_API='https://pos-api.terominds.com/api'
export TERO_API_KEY='tero_live_aabbccdd_xxxxxxxx'
export TERO_TENANT_ID='00000000-0000-0000-0000-000000000001'

curl -sS -X POST "$TERO_API/integration/v1/webhooks?tenantId=$TERO_TENANT_ID" \
  -H "Authorization: Bearer $TERO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://erp.miempresa.com/hooks/tero",
    "location_ids": [],
    "event_types": []
  }'

{
  "ok": true,
  "webhook": {
    "id": "b6b0e0d0-0000-4000-8000-000000000000",
    "url": "https://erp.miempresa.com/hooks/tero",
    "secret_prefix": "whsec_ab12cd",
    "enabled": true,
    "location_ids": [],
    "event_types": [],
    "created_at": "2026-10-21T19:00:00.000Z",
    "last_delivery": null
  },
  "secret": "whsec_ab12cd..."
}

import { createHmac, timingSafeEqual } from 'node:crypto'

const SECRET = process.env.TERO_WEBHOOK_SECRET

export function verifyTeroSignature({ headers, rawBody }) {
  const signature = headers['x-tero-signature']
  const timestamp = headers['x-tero-timestamp']
  if (!signature || !timestamp) return false

  // Tolerancia de reloj: 5 minutos.
  const now = Math.floor(Date.now() / 1000)
  if (Math.abs(now - Number(timestamp)) > 300) return false

  const expected =
    'v1=' + createHmac('sha256', SECRET).update(`${timestamp}.${rawBody}`).digest('hex')
  const a = Buffer.from(signature)
  const b = Buffer.from(expected)
  return a.length === b.length && timingSafeEqual(a, b)
}

import hashlib
import hmac
import time

SECRET = os.environ["TERO_WEBHOOK_SECRET"].encode()

def verify_tero_signature(headers, raw_body: bytes) -> bool:
    signature = headers.get("X-Tero-Signature")
    timestamp = headers.get("X-Tero-Timestamp")
    if not signature or not timestamp:
        return False

    if abs(int(time.time()) - int(timestamp)) > 300:
        return False

    expected = "v1=" + hmac.new(
        SECRET, f"{timestamp}.".encode() + raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)