Webhooks

import { createHmac, timingSafeEqual } from "node:crypto"

const MAX_TIMESTAMP_AGE_SECONDS = 5 * 60

type WebhookHeaders = {
  "webhook-id": string
  "webhook-signature": string
  "webhook-timestamp": string
}

export function verifyBahnWebhook(
  rawBody: string,
  headers: WebhookHeaders,
  signingSecret: string,
  now = Date.now(),
) {
  const timestamp = Number(headers["webhook-timestamp"])
  const age = Math.abs(Math.floor(now / 1000) - timestamp)
  if (!Number.isInteger(timestamp) || age > MAX_TIMESTAMP_AGE_SECONDS) {
    throw new Error("The webhook timestamp is not valid.")
  }

  if (!signingSecret.startsWith("whsec_")) {
    throw new Error("The webhook signing secret is not valid.")
  }

  const key = Buffer.from(signingSecret.slice("whsec_".length), "base64")
  const content = `${headers["webhook-id"]}.${headers["webhook-timestamp"]}.${rawBody}`
  const expected = createHmac("sha256", key).update(content).digest()

  const valid = headers["webhook-signature"].split(" ").some((signature) => {
    const [version, encoded] = signature.split(",", 2)
    if (version !== "v1" || !encoded) return false
    const received = Buffer.from(encoded, "base64")
    return received.length === expected.length && timingSafeEqual(received, expected)
  })

  if (!valid) throw new Error("The webhook signature is not valid.")
  return JSON.parse(rawBody)
}