Webhooks

import express from "express";
import { createHmac, timingSafeEqual } from "node:crypto";

const SECRET = process.env.FOMOQUANT_WEBHOOK_SECRET!; // whsec_…, shown once at creation
const TOLERANCE_SEC = 300;

function verify(rawBody: Buffer, header: string | undefined) {
  if (!header) throw new Error("missing FomoQuant-Signature");
  const parts = new Map(header.split(",").map((p) => p.split("=", 2) as [string, string]));
  const t = Number(parts.get("t"));
  if (!Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > TOLERANCE_SEC) throw new Error("stale timestamp");
  const expected = createHmac("sha256", SECRET).update(`${t}.`).update(rawBody).digest();
  const given = Buffer.from(parts.get("v1") ?? "", "hex");
  if (given.length !== expected.length || !timingSafeEqual(given, expected)) throw new Error("bad signature");
  return JSON.parse(rawBody.toString("utf8"));
}

const app = express();
// Verify against the RAW body — never a re-serialised JSON object.
app.post("/fomoquant", express.raw({ type: "application/json" }), (req, res) => {
  let event;
  try {
    event = verify(req.body, req.get("FomoQuant-Signature"));
  } catch {
    return res.status(400).send("invalid signature");
  }
  if (alreadyProcessed(event.id)) return res.sendStatus(200); // deliveries can repeat
  queue(event);                                               // do the work async
  res.sendStatus(200);                                        // answer within 10 s
});