Signature verification

// webhook-server.mjs (Node.js 18+). Install with: npm install express
import crypto from "node:crypto";
import express from "express";

const SECRET = process.env.REHABIFY_WEBHOOK_SECRET; // whsec_… for this environment
const TOLERANCE_SECONDS = 300;

export function verifyRehabifySignature(rawBody, header, secret, now = Math.floor(Date.now() / 1000)) {
  if (!header || !Buffer.isBuffer(rawBody)) return false;

  let timestamp = null;
  const signatures = [];
  for (const part of header.split(",")) {
    const i = part.indexOf("=");
    if (i === -1) continue;
    const key = part.slice(0, i).trim();
    const value = part.slice(i + 1).trim();
    if (key === "t") timestamp = value;
    else if (key === "v1") signatures.push(value);
  }
  if (!timestamp || !/^\d+$/.test(timestamp) || signatures.length === 0) return false;
  if (Math.abs(now - Number(timestamp)) > TOLERANCE_SECONDS) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.`)
    .update(rawBody)
    .digest(); // 32-byte Buffer

  return signatures.some((sig) => {
    const received = Buffer.from(sig, "hex");
    // timingSafeEqual throws a RangeError if the lengths differ, so check them first.
    return received.length === expected.length && crypto.timingSafeEqual(received, expected);
  });
}

const app = express();

// express.raw() keeps the exact bytes that were signed.
// Register this route BEFORE any app.use(express.json()), or the raw body is lost.
app.post("/webhooks/rehabify", express.raw({ type: "application/json" }), (req, res) => {
  if (!verifyRehabifySignature(req.body, req.get("X-Rehabify-Signature"), SECRET)) {
    return res.status(400).send("invalid signature");
  }

  const event = JSON.parse(req.body.toString("utf8"));
  // 1. Skip events whose id you've already processed.
  // 2. Queue the work, and ignore stale events using data.sequence.
  console.log("Verified", event.id, event.type);
  res.sendStatus(200); // respond within 10 seconds
});

app.listen(3000);