Verify signatures

import express from 'express';
import { verifyWebhook } from '@prudra/webhooks';

app.post(
  '/webhooks/prudra',
  express.raw({ type: '*/*' }),  // must run BEFORE express.json()
  (req, res) => {
    res.sendStatus(200);  // always respond 200 quickly

    const isValid = verifyWebhook({
      payload:   req.body as Buffer,
      signature: req.headers['x-prudra-signature'] as string,
      timestamp: req.headers['x-prudra-timestamp'] as string,
      secret:    process.env.PRUDRA_WEBHOOK_SECRET!,
    });

    if (!isValid) {
      console.warn('Invalid webhook signature — ignoring');
      return;
    }

    const event = JSON.parse((req.body as Buffer).toString());
    // Handle event...
  }
);

import crypto from 'crypto';

function verifyWebhookSignature(
  rawBody:   Buffer,
  signature: string,
  timestamp: string,
  secret:    string,
): boolean {
  // Check timestamp is within 5 minutes to prevent replay
  const fiveMinutes = 5 * 60 * 1000;
  const ts = parseInt(timestamp, 10) * 1000;
  if (Math.abs(Date.now() - ts) > fiveMinutes) {
    return false;
  }

  // Compute expected signature
  const signedPayload = `${timestamp}.${rawBody.toString()}`;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  const received = signature.replace('sha256=', '');

  // Constant-time comparison
  return crypto.timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(received, 'hex'),
  );
}

sha256=<hex-digest>

<timestamp>.<raw-body>

// Webhook route — uses express.raw()
app.post('/webhooks/prudra', express.raw({ type: '*/*' }), handler);

// Other routes — uses express.json() normally
app.use(express.json());