Pay-in Callback

import { createHmac, timingSafeEqual } from 'node:crypto';

function required(name) {
  const value = process.env[name]?.trim();
  if (!value) throw new Error(name + ' is required');
  return value;
}
const key = required('UUGATE_API_KEY');
const timestamp = required('UUGATE_CALLBACK_TIMESTAMP'), nonce = required('UUGATE_CALLBACK_NONCE');
const signature = required('UUGATE_CALLBACK_SIGNATURE');
const chunks = [];
for await (const chunk of process.stdin) chunks.push(chunk);
const rawBody = Buffer.concat(chunks);
const expected = createHmac('sha256', key).update(timestamp + '.' + nonce + '.', 'utf8').update(rawBody).digest();
const actual = Buffer.from(signature, 'hex');
if (!/^[a-fA-F0-9]{64}$/.test(signature) || actual.length !== expected.length || !timingSafeEqual(expected, actual))
  throw new Error('Invalid callback signature');
console.log('VERIFIED');

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.HexFormat;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class UUGateCallback {
    static String required(String name) {
        String value = System.getenv(name);
        if (value == null || value.isBlank()) throw new IllegalArgumentException(name + " is required");
        return value.trim();
    }
    public static void main(String[] args) throws Exception {
        String key = required("UUGATE_API_KEY");
        String timestamp = required("UUGATE_CALLBACK_TIMESTAMP"), nonce = required("UUGATE_CALLBACK_NONCE");
        String signature = required("UUGATE_CALLBACK_SIGNATURE");
        byte[] rawBody = System.in.readAllBytes();
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        mac.update((timestamp + "." + nonce + ".").getBytes(StandardCharsets.UTF_8));
        byte[] expected = mac.doFinal(rawBody);
        if (!signature.matches("[a-fA-F0-9]{64}") ||
            !MessageDigest.isEqual(expected, HexFormat.of().parseHex(signature)))
            throw new IllegalArgumentException("Invalid callback signature");
        System.out.println("VERIFIED");
    }
}

<?php
function required(string $name): string {
    $value = trim((string) getenv($name));
    if ($value === '') throw new RuntimeException($name . ' is required');
    return $value;
}
$key = required('UUGATE_API_KEY');
$timestamp = required('UUGATE_CALLBACK_TIMESTAMP'); $nonce = required('UUGATE_CALLBACK_NONCE');
$signature = required('UUGATE_CALLBACK_SIGNATURE');
$rawBody = file_get_contents('php://stdin');
if ($rawBody === false) throw new RuntimeException('Cannot read raw body');
$expected = hash_hmac('sha256', $timestamp . '.' . $nonce . '.' . $rawBody, $key);
if (!preg_match('/^[a-fA-F0-9]{64}$/D', $signature) || !hash_equals($expected, strtolower($signature)))
    throw new RuntimeException('Invalid callback signature');
echo 'VERIFIED', PHP_EOL;

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "io"
    "os"
    "strings"
)
func required(name string) string {
    value := strings.TrimSpace(os.Getenv(name))
    if value == "" { panic(name + " is required") }
    return value
}
func main() {
    key := required("UUGATE_API_KEY")
    timestamp, nonce := required("UUGATE_CALLBACK_TIMESTAMP"), required("UUGATE_CALLBACK_NONCE")
    signature := required("UUGATE_CALLBACK_SIGNATURE")
    rawBody, err := io.ReadAll(os.Stdin); if err != nil { panic(err) }
    mac := hmac.New(sha256.New, []byte(key))
    mac.Write([]byte(timestamp + "." + nonce + ".")); mac.Write(rawBody)
    actual, err := hex.DecodeString(signature)
    if err != nil || !hmac.Equal(mac.Sum(nil), actual) { panic("Invalid callback signature") }
    fmt.Println("VERIFIED")
}