Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyWebhook(
  rawBody: string, // exact bytes; read before any JSON parsing
  headers: { id: string; timestamp: string; signature: string },
  secret: string, // whsec_...
): boolean {
  if (!headers.id || !headers.timestamp || !headers.signature) return false;

  // Reject stale timestamps (replay protection)
  const skew = Math.abs(Date.now() / 1000 - Number(headers.timestamp));
  if (!Number.isFinite(skew) || skew > 300) return false;

  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const signedContent = `${headers.id}.${headers.timestamp}.${rawBody}`;
  const expected = Buffer.from(
    createHmac("sha256", key).update(signedContent).digest("base64"),
  );

  // Header may carry several space-separated "v1,<base64>" candidates
  return headers.signature.split(" ").some((part) => {
    const [version, value] = part.trim().split(",", 2);
    if (version !== "v1" || !value) return false;
    const candidate = Buffer.from(value);
    return candidate.length === expected.length && timingSafeEqual(candidate, expected);
  });
}

// Express example: note express.raw(), not express.json()
app.post("/webhooks/prescience", express.raw({ type: "application/json" }), (req, res) => {
  const ok = verifyWebhook(
    req.body.toString("utf8"),
    {
      id: req.header("webhook-id") ?? "",
      timestamp: req.header("webhook-timestamp") ?? "",
      signature: req.header("webhook-signature") ?? "",
    },
    process.env.PRESCIENCE_WEBHOOK_SECRET!,
  );
  if (!ok) return res.status(401).send("invalid signature");

  const event = JSON.parse(req.body.toString("utf8"));
  // ...route on event.type, dedupe on event.id...
  res.status(200).send("ok");
});