Webhooks

import crypto from "crypto";
import { Request, Response } from "express";

const WEBHOOK_SECRET = process.env.TIMELY_WEBHOOK_SECRET!;

export function verifySignature(req: Request, res: Response, next: Function) {
  const signature = req.headers["x-timely-signature"] as string;
  const rawBody = (req as any).rawBody as Buffer; // body-parser com verify

  if (!signature || !rawBody) {
    return res.status(401).json({ error: "Missing signature" });
  }

  const expected = "sha256=" + crypto
    .createHmac("sha256", WEBHOOK_SECRET)
    .update(rawBody)
    .digest("hex");

  const isValid = crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );

  if (!isValid) {
    return res.status(401).json({ error: "Invalid signature" });
  }

  next();
}