Webhooks

import { createHmac, timingSafeEqual } from "node:crypto"

const MAX_TIMESTAMP_AGE_SECONDS = 5 * 60

type WebhookHeaders = {
  "webhook-id": string
  "webhook-signature": string
  "webhook-timestamp": string
}

export function verifyBahnWebhook(
  rawBody: Uint8Array,
  headers: WebhookHeaders,
  signingSecret: string,
  now = Date.now(),
) {
  const timestamp = Number(headers["webhook-timestamp"])
  const age = Math.abs(Math.floor(now / 1000) - timestamp)
  if (!Number.isInteger(timestamp) || age > MAX_TIMESTAMP_AGE_SECONDS) {
    throw new Error("The webhook timestamp is not valid.")
  }

  if (!signingSecret.startsWith("whsec_")) {
    throw new Error("The webhook signing secret is not valid.")
  }

  const key = Buffer.from(signingSecret.slice("whsec_".length), "base64")
  const prefix = `${headers["webhook-id"]}.${headers["webhook-timestamp"]}.`
  const expected = createHmac("sha256", key).update(prefix).update(rawBody).digest()

  const valid = headers["webhook-signature"].split(" ").some((signature) => {
    const [version, encoded] = signature.split(",", 2)
    if (version !== "v1" || !encoded) return false
    const received = Buffer.from(encoded, "base64")
    return received.length === expected.length && timingSafeEqual(received, expected)
  })

  if (!valid) throw new Error("The webhook signature is not valid.")
  return JSON.parse(Buffer.from(rawBody).toString("utf8"))
}

{
  "specversion": "1.0",
  "id": "evt_01k1a2b3c4d5e6f7g8h9j0k1m2",
  "source": "https://sandbox.api.bahnexpress.fi/v2",
  "type": "com.bahn.order.created.v1",
  "subject": "orders/ord_01k1a2b3c4d5e6f7g8h9j0k1m2",
  "time": "2026-08-03T08:40:00+03:00",
  "datacontenttype": "application/json",
  "data": {
    "order_id": "ord_01k1a2b3c4d5e6f7g8h9j0k1m2",
    "ordered_for": null,
    "order_sequence": 1,
    "resource_url": "/v2/orders/ord_01k1a2b3c4d5e6f7g8h9j0k1m2",
    "status": "accepted"
  }
}