Webhooks

import crypto from "node:crypto";

const TOLERANCE = 5 * 60; // 5 minutes

export function verifyKodiscSignature(
  rawBody: string,
  header: string | null,
  secret: string,
): boolean {
  if (!header) return false;

  const parts = Object.fromEntries(
    header.split(",").map((p) => {
      // Only split on the first `=` so base64-padded values survive intact.
      const [k, ...rest] = p.trim().split("=");
      const v = rest.join("=");
      return [k, v] as [string, string];
    }),
  );
  const timestamp = parts.t;
  const received = parts.v1;
  if (!timestamp || !received) return false;

  // Reject deliveries whose timestamp is outside the freshness window —
  // prevents replay of captured signed requests.
  if (Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp)) > TOLERANCE) {
    return false;
  }

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(received, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}