16 lines
1.3 KiB
TypeScript
16 lines
1.3 KiB
TypeScript
import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
|
|
|
|
export function createWebhookSecret() { return randomBytes(32).toString("base64url"); }
|
|
export function webhookSecretHash(secret: string) { return createHash("sha256").update(secret).digest("hex"); }
|
|
export function webhookSecretMatches(secret: string, expectedHash: string | null) {
|
|
if (!expectedHash) return false;
|
|
const actual = Buffer.from(webhookSecretHash(secret), "hex");
|
|
const expected = Buffer.from(expectedHash, "hex");
|
|
return actual.length === expected.length && timingSafeEqual(actual, expected);
|
|
}
|
|
export function standardWebhookMatches(secret: string, id: string | null, timestamp: string | null, signature: string | null, body: string) {
|
|
const seconds = Number(timestamp); if (!id || !timestamp || !signature || !Number.isFinite(seconds) || !Number.isInteger(seconds) || Math.abs(Date.now() / 1000 - seconds) > 300) return false;
|
|
const expected = createHmac("sha256", secret).update(`${id}.${timestamp}.${body}`).digest("base64");
|
|
return signature.split(" ").some((item) => { const [version, value] = item.split(","); if (version !== "v1" || !value) return false; const actual = Buffer.from(value); const target = Buffer.from(expected); return actual.length === target.length && timingSafeEqual(actual, target); });
|
|
}
|