use axum::{
    body::Bytes,
    extract::State,
    http::{HeaderMap, StatusCode},
    Router,
};
use hmac::{Hmac, Mac};
use sha2::Sha256;

fn verify_photon_webhook(
    raw_body: &str,
    signing_secret: &str,
    signature: &str,  // X-Photon-Signature header
    timestamp: &str,  // X-Photon-Timestamp header
) -> bool {
    let sig_base = format!("v0:{}:{}", timestamp, raw_body);
    let mut mac = Hmac::<Sha256>::new_from_slice(signing_secret.as_bytes())
        .expect("HMAC accepts any key size");
    mac.update(sig_base.as_bytes());
    let expected = format!("v0={}", hex::encode(mac.finalize().into_bytes()));
    expected == signature
}

// Axum handler
async fn webhook(
    State(secret): State<String>,
    headers: HeaderMap,
    body: Bytes,
) -> StatusCode {
    let sig = headers.get("x-photon-signature").and_then(|v| v.to_str().ok()).unwrap_or("");
    let ts  = headers.get("x-photon-timestamp").and_then(|v| v.to_str().ok()).unwrap_or("");
    let raw = std::str::from_utf8(&body).unwrap_or("");

    if !verify_photon_webhook(raw, &secret, sig, ts) {
        return StatusCode::UNAUTHORIZED;
    }
    // handle payload...
    StatusCode::OK
}
Advanced iMessage Kit Webhook
