HioBuy Webhooks Demo

import crypto from "node:crypto";

const TOLERANCE_SEC = 300;

export function verifyHioBuyWebhook({
  rawBody,
  signature,
  secret,
}: {
  rawBody: string;
  signature: string | null;
  secret: string;
}) {
  const match = /^t=(\d+),v1=([0-9a-f]+)$/i.exec(signature || "");
  if (!match) return false;

  const timestamp = Number(match[1]);
  const expected = match[2].toLowerCase();
  if (!Number.isFinite(timestamp)) return false;

  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - timestamp) > TOLERANCE_SEC) return false;

  const signedPayload = `${timestamp}.${rawBody}`;
  const digest = crypto
    .createHmac("sha256", secret)
    .update(signedPayload, "utf8")
    .digest("hex");

  const a = Buffer.from(digest, "utf8");
  const b = Buffer.from(expected, "utf8");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}