Webhooks

import { createHmac, timingSafeEqual } from 'node:crypto'

// header: "t=1791394200,v1=5f1c…"
export function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(
    header.split(',').map((part) => part.split('=')),
  )
  // Reject anything older than five minutes.
  if (Date.now() / 1000 - Number(parts.t) > 300) return false
  const expected = createHmac('sha256', secret)
    .update(`${parts.t}.${rawBody}`)
    .digest('hex')
  const a = Buffer.from(expected)
  const b = Buffer.from(parts.v1 ?? '')
  return a.length === b.length && timingSafeEqual(a, b)
}