const crypto = require('crypto');

// Replace with your actual signing secret
const BOLT_SIGNING_SECRET = 'your_signing_secret_here';

// This would typically come from the request headers
const hmacHeader = req.headers['X-Bolt-Hmac-Sha256'];

function verifyWebhook(payload, hmacHeader) {
  const computedHmac = crypto
    .createHmac('sha256', BOLT_SIGNING_SECRET)
    .update(payload, 'utf8')
    .digest('base64');

  return computedHmac === hmacHeader;
}

$hmac_header = $_SERVER['X-Bolt-Hmac-Sha256'];

function verify_webhook($payload, $hmac_header) {
  $computed_hmac = base64_encode(hash_hmac('sha256', $payload, BOLT_SIGNING_SECRET, true));
  return ($computed_hmac == $hmac_header);
}