التحقق من تواقيع الـ Webhooks

import crypto from 'node:crypto';
import express from 'express';

const WEBHOOK_SECRET = process.env.TEYRA_WEBHOOK_SECRET; // whsec_...
const TOLERANCE_SECONDS = 300;

export function verifyTeyraSignature(rawBody, header, secret, now = Date.now()) {
  if (!header) return false;
  let timestamp = null;
  const signatures = [];
  for (const part of header.split(',')) {
    const i = part.indexOf('=');
    if (i === -1) continue;
    const key = part.slice(0, i).trim();
    const value = part.slice(i + 1).trim();
    if (key === 't') timestamp = value;
    else if (key === 'v1') signatures.push(value);
  }
  if (!timestamp || !/^\d+$/.test(timestamp) || signatures.length === 0) return false;
  if (Math.abs(Math.floor(now / 1000) - Number(timestamp)) > TOLERANCE_SECONDS) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.`)
    .update(rawBody) // Buffer with the exact bytes received
    .digest();

  return signatures.some((sig) => {
    const given = Buffer.from(sig, 'hex');
    return given.length === expected.length && crypto.timingSafeEqual(given, expected);
  });
}

const app = express();

// express.raw keeps the body as a Buffer. Don't use express.json() on this route.
app.post('/hooks/teyra', express.raw({ type: 'application/json' }), async (req, res) => {
  if (!verifyTeyraSignature(req.body, req.get('Teyra-Signature'), WEBHOOK_SECRET)) {
    return res.status(400).send('Invalid signature');
  }
  const event = JSON.parse(req.body.toString('utf8'));

  if (await alreadyProcessed(event.id)) return res.sendStatus(200);
  await queueEventForProcessing(event); // do slow work in the background
  res.sendStatus(200);
});