SIEM export

import hashlib
import hmac
import time

TOLERANCE_SECONDS = 300


def verify_promptguard_signature(secret, timestamp, signature, body, now=None):
    """True when `body` (raw bytes) was signed by PromptGuard within the window."""
    if not timestamp or not timestamp.isdigit():
        return False
    if abs((time.time() if now is None else now) - int(timestamp)) > TOLERANCE_SECONDS:
        return False
    digest = hmac.new(secret.encode(), timestamp.encode() + b"." + body, hashlib.sha256)
    expected = "v1=" + digest.hexdigest()
    return any(hmac.compare_digest(expected, part.strip()) for part in (signature or "").split(","))


# Flask:
# @app.post("/promptguard")
# def receive():
#     if not verify_promptguard_signature(
#         SECRET,
#         request.headers.get("X-PromptGuard-Timestamp"),
#         request.headers.get("X-PromptGuard-Signature"),
#         request.get_data(),
#     ):
#         abort(401)
#     event = request.get_json()
#     ...

const crypto = require("node:crypto")

const TOLERANCE_SECONDS = 300

function verifyPromptGuardSignature(secret, timestamp, signature, rawBody, now = Date.now() / 1000) {
  if (!/^\d+$/.test(timestamp ?? "")) return false
  if (Math.abs(now - Number(timestamp)) > TOLERANCE_SECONDS) return false
  const expected = Buffer.from(
    `v1=${crypto.createHmac("sha256", secret).update(`${timestamp}.`).update(rawBody).digest("hex")}`,
  )
  return (signature ?? "").split(",").some((part) => {
    const candidate = Buffer.from(part.trim())
    return candidate.length === expected.length && crypto.timingSafeEqual(candidate, expected)
  })
}

// Express: read the raw body, not the parsed one.
// app.post("/promptguard", express.raw({ type: "application/json" }), (req, res) => {
//   const ok = verifyPromptGuardSignature(
//     process.env.PROMPTGUARD_SIGNING_SECRET,
//     req.get("X-PromptGuard-Timestamp"),
//     req.get("X-PromptGuard-Signature"),
//     req.body,
//   )
//   if (!ok) return res.sendStatus(401)
//   const event = JSON.parse(req.body)
//   res.sendStatus(200)
// })