التحقق من التوقيع

const crypto = require('node:crypto');

const TOLERANCE_SECONDS = 300;

function verifyOctaneSignature(rawBody, header, secret) {
  if (typeof header !== 'string') return false;

  const parts = Object.fromEntries(
    header.split(',').map((kv) => kv.split('=').map((s) => s.trim())),
  );
  const t = Number(parts.t);
  const v1 = parts.v1;
  if (!Number.isFinite(t) || !v1) return false;

  if (Math.abs(Date.now() / 1000 - t) > TOLERANCE_SECONDS) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${t}.${rawBody}`)
    .digest('hex');

  const a = Buffer.from(expected, 'hex');
  const b = Buffer.from(v1, 'hex');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Express: keep the raw body for this route
const express = require('express');
const app = express();

app.post(
  '/webhooks/octane',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const rawBody = req.body.toString('utf8');
    const ok = verifyOctaneSignature(
      rawBody,
      req.get('X-Octane-Signature'),
      process.env.OCTANE_WEBHOOK_SECRET,
    );
    if (!ok) return res.status(401).send('invalid signature');

    const event = JSON.parse(rawBody);
    // Acknowledge first, process asynchronously
    res.sendStatus(200);
    queue.enqueue(event);
  },
);