ওয়েবহুক

curl -s -X POST "https://api.framique.com/api/public/v1/webhooks" \
  -H "Authorization: Bearer $FRAMIQUE_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://app.example.com/hooks/framique",
    "events": ["order.created", "order.paid", "product.updated"],
    "description": "Fulfilment sync"
  }'

import { createHmac, timingSafeEqual } from "node:crypto";

const TOLERANCE_SECONDS = 300;

export function verify(raw: string, headers: Headers, secret: string): boolean {
  const timestamp = headers.get("x-framique-timestamp");
  const signature = headers.get("x-framique-signature");
  if (!timestamp || !signature) return false;

  // Reject anything outside the window before spending a hash on it.
  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!Number.isFinite(age) || age > TOLERANCE_SECONDS) return false;

  const expected = createHmac("sha256", secret).update(`${timestamp}.${raw}`).digest("hex");
  const a = Buffer.from(signature, "utf8");
  const b = Buffer.from(expected, "utf8");
  // Length check first: timingSafeEqual throws on a length mismatch.
  return a.length === b.length && timingSafeEqual(a, b);
}