Verify the signature

const crypto = require('crypto');

app.post('/hooks/mizaniya',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const ts  = req.get('X-Timestamp') ?? '';
    const sig = req.get('X-Signature') ?? '';

    if (Math.abs(Date.now() - Number(ts)) > 300000)
      return res.status(400).send('stale');

    const expected = crypto
      .createHmac('sha256', process.env.MIZANIYA_WEBHOOK_SECRET)
      .update(Buffer.concat([req.body, Buffer.from(ts)]))
      .digest('hex');

    if (expected.length !== sig.length ||
        !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig)))
      return res.status(401).send('bad signature');

    const event = JSON.parse(req.body.toString('utf8'));
    // skip if event.deliveryId already processed
    res.sendStatus(200);
  });

$body = file_get_contents('php://input');
$ts   = $_SERVER['HTTP_X_TIMESTAMP'] ?? '';
$sig  = $_SERVER['HTTP_X_SIGNATURE'] ?? '';

if (abs(round(microtime(true) * 1000) - (int) $ts) > 300000) {
    http_response_code(400); exit('stale');
}

$expected = hash_hmac('sha256', $body . $ts,
                      getenv('MIZANIYA_WEBHOOK_SECRET'));

if (!hash_equals($expected, $sig)) {
    http_response_code(401); exit('bad signature');
}

$event = json_decode($body, true);
// skip if $event['deliveryId'] already processed
http_response_code(200);