Webhook signature verifier

import { checkWebhookSignature } from "@workwae/sdk";

export async function POST(request: Request): Promise<Response> {
  // The raw body, exactly as received. Parsed and
  // re-serialized JSON does not verify.
  const body = await request.text();
  const failure = await checkWebhookSignature(
    // whsec_...; a TypeError if it is not base64
    process.env.WORKWAE_WEBHOOK_SECRET!,
    request.headers,
    body,
  );
  if (failure) {
    // "missing_headers" | "timestamp" | "signature"
    console.warn(`Webhook refused: ${failure}`);
    return new Response("Invalid webhook", { status: 400 });
  }
  const event = JSON.parse(body);
  // Handle event.type and event.data here.
  return new Response(null, { status: 204 });
}

import { createHmac, timingSafeEqual } from "node:crypto";

const TOLERANCE_SECONDS = 300;

export function verifyWorkwaeWebhook(
  secret: string,
  headers: Headers,
  body: string,
): boolean {
  const id = headers.get("webhook-id");
  const timestamp = headers.get("webhook-timestamp");
  const signatures = headers.get("webhook-signature");
  if (!id || !timestamp || !signatures) return false;
  if (!/^[0-9]{1,15}$/.test(timestamp)) return false;
  // Refuses a replay of an old, captured request.
  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (age > TOLERANCE_SECONDS) return false;

  // The key is the base64 text after "whsec_".
  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  if (key.length === 0) throw new TypeError("Secret is not base64");
  const expected = createHmac("sha256", key)
    .update(`${id}.${timestamp}.${body}`)
    .digest();

  // Space-separated "v1,<base64>" entries (two while a secret
  // rotates; the first 8 count). One match is enough.
  return signatures.split(" ", 8).some((candidate) => {
    const [version, value] = candidate.split(",", 2);
    if (version !== "v1" || !value) return false;
    const given = Buffer.from(value, "base64");
    return (
      given.length === expected.length &&
      timingSafeEqual(given, expected)
    );
  });
}

// In a fetch-style handler (Bun.serve, Hono, a Next.js route):
//   const body = await request.text(); // raw, before parsing
//   const secret = process.env.WORKWAE_WEBHOOK_SECRET!;
//   if (!verifyWorkwaeWebhook(secret, request.headers, body))
//     return new Response("Invalid webhook", { status: 400 });