Verify webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyLynqWebhook(
  rawBody: string,
  signatureHeader: string,
  secret: string,
) {
  const parts = Object.fromEntries(
    signatureHeader.split(",").map((part) => part.split("=", 2)),
  );

  const timestamp = Number(parts.t);
  const receivedSignature = parts.v1;

  if (!Number.isSafeInteger(timestamp) || !receivedSignature) return false;

  // Recommended replay protection: accept requests no older than five minutes.
  const ageSeconds = Math.abs(Math.floor(Date.now() / 1000) - timestamp);
  if (ageSeconds > 300) return false;

  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const received = Buffer.from(receivedSignature, "hex");
  const calculated = Buffer.from(expected, "hex");

  return received.length === calculated.length &&
    timingSafeEqual(received, calculated);
}

async function handleLynqEvent(event: LynqWebhookEvent) {
  if (await webhookEvents.exists(event.id)) return;

  await database.transaction(async (transaction) => {
    await transaction.webhookEvents.insert({ id: event.id });

    if (event.type === "payment_intent.succeeded") {
      await transaction.orders.markPaid({
        orderId: event.data.orderId,
        paymentIntentId: event.data.id,
        amount: event.data.amount,
        currency: event.data.currency,
      });
    }
  });
}