Verifying signatures

import crypto from 'node:crypto';

const FIVE_MINUTES_MS = 5 * 60 * 1000;

function verifyWebhook(rawBody, headers, secret) {
  const sigHeader = headers['x-bloobank-signature'];
  if (!sigHeader) throw new Error('Missing signature header');

  // Parse "t=...,v1=...,v1=..."
  const parts = Object.fromEntries(
    sigHeader.split(',').map(p => {
      const [k, v] = p.split('=', 2);
      return [k.trim(), v.trim()];
    })
  );
  // Multiple v1 signatures are possible (during rotation); collect all
  const v1Sigs = sigHeader
    .split(',')
    .filter(p => p.trim().startsWith('v1='))
    .map(p => p.split('=', 2)[1].trim());

  const ts = Number(parts.t);
  if (!Number.isFinite(ts)) throw new Error('Invalid timestamp');
  if (Math.abs(Date.now() - ts) > FIVE_MINUTES_MS) {
    throw new Error('Timestamp outside ±5 minutes — likely replay');
  }

  const signedPayload = `${parts.t}.${rawBody}`;
  const expected = crypto.createHmac('sha256', secret)
                         .update(signedPayload)
                         .digest('hex');

  const expectedBuf = Buffer.from(expected, 'hex');
  const ok = v1Sigs.some(sig => {
    const sigBuf = Buffer.from(sig, 'hex');
    return sigBuf.length === expectedBuf.length
        && crypto.timingSafeEqual(sigBuf, expectedBuf);
  });
  if (!ok) throw new Error('Signature mismatch');

  return JSON.parse(rawBody);
}

// Express example
app.post('/webhooks/bloobank', express.raw({ type: 'application/json' }), (req, res) => {
  try {
    const event = verifyWebhook(req.body.toString('utf8'), req.headers, process.env.BLOOBANK_WEBHOOK_SECRET);
    enqueueAsync(event);            // do real work elsewhere
    res.status(200).end();
  } catch (err) {
    console.error('Webhook verification failed:', err);
    res.status(401).end();
  }
});