Verify signatures

{webhook-id}.{webhook-timestamp}.{raw-request-body}

import { createHmac, timingSafeEqual } from 'node:crypto';

type VerificationInput = {
  rawBody: string;
  webhookId: string | undefined;
  webhookTimestamp: string | undefined;
  webhookSignature: string | undefined;
  secret: string;
};

export function verifyWircleWebhook({
  rawBody,
  webhookId,
  webhookTimestamp,
  webhookSignature,
  secret,
}: VerificationInput) {
  if (
    !webhookId
    || !webhookTimestamp
    || !webhookSignature?.startsWith('v1,')
    || !secret.startsWith('whsec_')
  ) {
    return false;
  }

  const timestamp = Number(webhookTimestamp);
  const toleranceSeconds = 5 * 60;

  if (
    !Number.isInteger(timestamp)
    || Math.abs(Math.floor(Date.now() / 1000) - timestamp) > toleranceSeconds
  ) {
    return false;
  }

  const encodedSecret = secret.slice('whsec_'.length);
  const signingKey = Buffer.from(encodedSecret, 'base64');

  // Wircle endpoint secrets decode to exactly 32 bytes.
  if (
    signingKey.length !== 32
    || signingKey.toString('base64') !== encodedSecret
  ) {
    return false;
  }

  const signingInput = `${webhookId}.${webhookTimestamp}.${rawBody}`;
  const expected = `v1,${createHmac('sha256', signingKey)
    .update(signingInput)
    .digest('base64')}`;
  const expectedBytes = Buffer.from(expected);
  const receivedBytes = Buffer.from(webhookSignature);

  return expectedBytes.length === receivedBytes.length
    && timingSafeEqual(expectedBytes, receivedBytes);
}