Verify webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyLynqWebhook(
  rawBody: string,
  signatureHeader: string,
  secret: string,
) {
  let timestamp = Number.NaN;
  const signatures: string[] = [];
  for (const part of signatureHeader.split(",")) {
    const [key, value] = part.split("=", 2);
    if (key === "t") timestamp = Number(value);
    if (key === "v1" && value) signatures.push(value);
  }

  if (!Number.isSafeInteger(timestamp) || signatures.length === 0) return false;

  // Recommended replay protection: accept requests no older than five minutes.
  const ageSeconds = Math.abs(Math.floor(Date.now() / 1000) - timestamp);
  if (ageSeconds > 300) return false;

  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest();

  // During a rotation overlap there is one signature per active secret.
  return signatures.some((signature) => {
    const received = Buffer.from(signature, "hex");
    return received.length === expected.length &&
      timingSafeEqual(received, expected);
  });
}

async function handleLynqEvent(event: LynqWebhookEvent) {
  if (await webhookEvents.exists(event.id)) return;

  await database.transaction(async (transaction) => {
    await transaction.webhookEvents.insert({ id: event.id });

    if (event.type === "payment_intent.succeeded") {
      await transaction.orders.markPaid({
        orderId: event.data.orderId,
        paymentIntentId: event.data.id,
        amount: event.data.amount,
        currency: event.data.currency,
      });
    }
  });
}