Webhooks Guide & Reference

import crypto from "crypto";

export interface VerifyWebhookOptions {
  rawBody: string;             // Exact raw request text body
  signatureHeader: string;     // Value of 'x-zynocode-signature' header
  secret: string;              // Your 'whsec_...' endpoint secret
  toleranceSeconds?: number;   // Max age in seconds (default: 300)
}

export function verifyZynocodeWebhook({
  rawBody,
  signatureHeader,
  secret,
  toleranceSeconds = 300,
}: VerifyWebhookOptions): boolean {
  if (!signatureHeader || !rawBody || !secret) return false;

  // 1. Parse header components (e.g. t=1729810000000,v1=abcdef...)
  const parts = signatureHeader.split(",").reduce<Record<string, string>>((acc, pair) => {
    const [k, v] = pair.split("=");
    if (k && v) acc[k.trim()] = v.trim();
    return acc;
  }, {});

  const timestamp = parts["t"];
  const expectedSignature = parts["v1"];
  if (!timestamp || !expectedSignature) return false;

  // 2. Prevent replay attacks (verify timestamp freshness)
  const tsNum = parseInt(timestamp, 10);
  if (isNaN(tsNum) || Math.abs(Date.now() - tsNum) > toleranceSeconds * 1000) {
    return false;
  }

  // 3. Extract eventId from JSON body
  let eventId = "";
  try {
    const parsed = JSON.parse(rawBody);
    eventId = parsed.eventId || "";
  } catch {
    return false;
  }

  // 4. Compute expected HMAC-SHA256 signature
  const signatureData = `${eventId}.${timestamp}.${rawBody}`;
  const computedSignature = crypto
    .createHmac("sha256", secret)
    .update(signatureData)
    .digest("hex");

  // 5. Compare signatures using timing-safe buffer comparison
  if (computedSignature.length !== expectedSignature.length) return false;
  return crypto.timingSafeEqual(
    Buffer.from(computedSignature, "utf8"),
    Buffer.from(expectedSignature, "utf8")
  );
}