Webhook delivery and security

t=<unix_seconds>,v1=<hex_hmac>

HMAC-SHA256(signing_secret, "<timestamp>.<raw_request_body>")

import { createHmac, timingSafeEqual } from "node:crypto";

function verifyFluentSignature({
  body,
  header,
  secret,
  toleranceSeconds = 300,
}: {
  body: Buffer;
  header: string | null;
  secret: string;
  toleranceSeconds?: number;
}): boolean {
  if (!header || toleranceSeconds < 0) return false;

  const parts = header.split(",").map((part) => part.trim());
  const timestampText = parts.find((part) => part.startsWith("t="))?.slice(2);
  const signatures = parts.filter((part) => part.startsWith("v1=")).map((part) => part.slice(3));
  if (!timestampText || signatures.length === 0) return false;

  const timestamp = Number(timestampText);
  const now = Math.floor(Date.now() / 1000);
  if (!Number.isInteger(timestamp) || Math.abs(now - timestamp) > toleranceSeconds) return false;

  const expected = createHmac("sha256", secret)
    .update(Buffer.from(`${timestampText}.`, "utf8"))
    .update(body)
    .digest();

  return signatures.some((signature) => {
    if (!/^[0-9a-f]{64}$/i.test(signature)) return false;
    const actual = Buffer.from(signature, "hex");
    return actual.length === expected.length && timingSafeEqual(actual, expected);
  });
}

export async function POST(request: Request) {
  const rawBody = Buffer.from(await request.arrayBuffer());
  const secret = process.env.FLUENT_WEBHOOK_SECRET;

  if (!secret) {
    return new Response("Webhook secret is not configured", { status: 500 });
  }

  const valid = verifyFluentSignature({
    body: rawBody,
    header: request.headers.get("Fluent-Signature"),
    secret,
  });

  if (!valid) {
    return new Response("Invalid signature", { status: 401 });
  }

  const event = JSON.parse(rawBody.toString("utf8"));
  // Persist event.id with a unique constraint, then enqueue business work.
  await persistWebhookEvent(event);
  return new Response(null, { status: 204 });
}