Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(header, rawBody, secret, now = Math.floor(Date.now() / 1000)) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=").map((s) => s.trim())));
  const timestamp = Number(parts.t);
  if (!timestamp || Math.abs(now - timestamp) > 300) return false;
  const expected = createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");
  const left = Buffer.from(expected);
  const right = Buffer.from(parts.v1 ?? "");
  return left.length === right.length && timingSafeEqual(left, right);
}