Webhooks

import { createHmac, timingSafeEqual } from 'node:crypto';

const TOLERANCE_SECONDS = 5 * 60;

export function verifyNlmcaSignature(rawBody, signatureHeader, secret) {
  let t = null;
  const signatures = [];
  for (const part of String(signatureHeader ?? '').split(',')) {
    const idx = part.indexOf('=');
    if (idx <= 0) continue;
    const key = part.slice(0, idx).trim();
    const value = part.slice(idx + 1).trim();
    if (key === 't' && /^\d+$/.test(value)) t = Number(value);
    else if (key === 'v1' && /^[0-9a-f]{64}$/i.test(value)) signatures.push(value.toLowerCase());
  }
  if (t === null || signatures.length === 0) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > TOLERANCE_SECONDS) return false;

  const expected = Buffer.from(createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex'), 'hex');
  return signatures.some((sig) => {
    const candidate = Buffer.from(sig, 'hex');
    return candidate.length === expected.length && timingSafeEqual(candidate, expected);
  });
}

import express from 'express';
import { verifyNlmcaSignature } from './verify.js';

const app = express();

app.post(
  '/hooks/nlmca',
  express.raw({ type: 'application/json' }), // keep the raw bytes
  (req, res) => {
    const raw = req.body.toString('utf8');
    const ok = verifyNlmcaSignature(raw, req.get('X-NLMCA-Signature'), process.env.NLMCA_WEBHOOK_SECRET);
    if (!ok) return res.status(400).send('bad signature');

    const event = JSON.parse(raw);
    res.status(200).end(); // acknowledge first, then do the work
    handleEvent(event).catch(console.error);
  },
);

async function handleEvent(event) {
  // dedupe on event.id, then act on event.type
}

app.listen(3000);