Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyWebhook(rawBody: Buffer, header: string, secret: string): boolean {
  if (!secret || !Buffer.isBuffer(rawBody)) return false;
  const parts: Record<string, string> = Object.create(null);
  for (const part of header.split(",")) {
    const pair = part.trim().split("=");
    if (pair.length !== 2 || Object.hasOwn(parts, pair[0])) return false;
    parts[pair[0]] = pair[1];
  }
  if (!/^[0-9]{1,12}$/.test(parts.t ?? "") || !/^[a-f0-9]{64}$/i.test(parts.v1 ?? "")) return false;
  const timestamp = Number(parts.t);
  if (Math.abs(Date.now() / 1000 - timestamp) > 300) return false;
  const expected = createHmac("sha256", secret)
    .update(`${parts.t}.`).update(rawBody).digest();
  const actual = Buffer.from(parts.v1, "hex");
  return actual.length === expected.length && timingSafeEqual(actual, expected);
}

import express from "express";
import { verifyWebhook } from "./verify-webhook.js";
import { persistEventOnce } from "./webhook-store.js";

const secret = process.env.CONTEXT_WEBHOOK_SECRET;
if (!secret) throw new Error("Set CONTEXT_WEBHOOK_SECRET before starting the receiver");

const app = express();
app.post("/webhooks/context", express.raw({ type: "application/json" }), async (req, res) => {
  if (!verifyWebhook(req.body, req.get("X-Context-Signature") ?? "", secret)) {
    res.status(401).send("Invalid webhook signature");
    return;
  }

  let event;
  try {
    event = JSON.parse(req.body.toString("utf8"));
  } catch {
    res.status(400).send("Invalid JSON");
    return;
  }
  if (!event || typeof event.id !== "string" || !event.id ||
      event.id !== req.get("X-Context-Id") ||
      typeof event.event !== "string" || event.event !== req.get("X-Context-Event")) {
    res.status(400).send("Invalid event envelope");
    return;
  }

  try {
    await persistEventOnce(event);
  } catch {
    res.status(503).send("Could not persist event");
    return;
  }
  res.sendStatus(204);
});

app.use(express.json());
app.listen(3000);