Webhook signatures

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const SECRET = process.env.ZYNDPAY_WEBHOOK_SECRET!;
const TOLERANCE_SECONDS = 300; // reject events older than 5 minutes

// Mount raw-body parser so we can hash the exact bytes ZyndPay signed.
app.post('/webhooks/zyndpay', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.header('zyndpay-signature') ?? '';
  const parts = Object.fromEntries(
    header.split(',').map((kv) => kv.split('=', 2) as [string, string]),
  );
  const timestamp = parts.t;
  const received = parts.v1;
  if (!timestamp || !received) return res.status(401).send('malformed signature');

  if (Math.abs(Date.now() / 1000 - Number(timestamp) / 1000) > TOLERANCE_SECONDS) {
    return res.status(401).send('timestamp out of tolerance');
  }

  const expected = crypto
    .createHmac('sha256', SECRET)
    .update(`${timestamp}.${req.body.toString('utf8')}`)
    .digest('hex');

  const a = Buffer.from(received);
  const b = Buffer.from(expected);
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).send('invalid signature');
  }

  const event = JSON.parse(req.body.toString('utf8'));
  // handle event.event (e.g. 'payin.confirmed') ...
  res.status(200).send('ok');
});