Webhooks

t=<unix-seconds>,v1=<hex-hmac>

import { createHmac, timingSafeEqual } from "node:crypto";

function verifyHarlyWebhook(
  rawBody: string,
  signatureHeader: string | null,
  secret: string,
  toleranceSeconds = 300,
): boolean {
  if (!signatureHeader) return false;

  // Parse t=<unix>,v1=<hex>
  const parts = Object.fromEntries(
    signatureHeader.split(",").map((kv) => kv.split("=") as [string, string]),
  );
  const t = Number.parseInt(parts.t ?? "", 10);
  const v1 = parts.v1;
  if (Number.isNaN(t) || !v1) return false;

  // Reject stale timestamps
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - t) > toleranceSeconds) return false;

  // Constant-time HMAC comparison
  const expected = createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(expected, "utf8");
  const b = Buffer.from(v1, "utf8");
  if (a.length !== b.length) return false;
  return timingSafeEqual(a, b);
}

// Express example
import express from "express";

const app = express();

app.post(
  "/harly/events",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const valid = verifyHarlyWebhook(
      req.body.toString(),
      req.headers["x-harly-signature-256"] as string ?? null,
      process.env.HARLY_WEBHOOK_SECRET!,
    );
    if (!valid) return res.status(400).json({ error: "invalid_signature" });

    const event = JSON.parse(req.body.toString());
    res.status(200).json({ received: true });

    // Deduplicate and process asynchronously
    processEvent(event).catch(console.error);
  },
);