Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyNorthFondWebhook(rawBody, signatureHeader, secret) {
  const fields = Object.fromEntries(
    signatureHeader.split(",").map((field) => field.split("=")),
  );
  const timestamp = fields.t;
  const received = Buffer.from(fields.v1, "hex");
  const expected = Buffer.from(
    createHmac("sha256", secret)
      .update(`${timestamp}.${rawBody}`)
      .digest("hex"),
    "hex",
  );

  const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
  return fresh && received.length === expected.length && timingSafeEqual(received, expected);
}