Verify signatures

import { createHmac, timingSafeEqual } from "node:crypto"

const TOLERANCE_SECONDS = 5 * 60

export interface AgooEvent<T = Record<string, unknown>> {
  id: string
  type: string
  created_at: string
  organisation_id: string
  livemode: boolean
  data: { object: T }
}

export class WebhookVerificationError extends Error {}

type HeaderSource = Headers | Record<string, string | string[] | undefined>

function readHeader(headers: HeaderSource, name: string): string | undefined {
  if (typeof headers.get === "function") return (headers as Headers).get(name) ?? undefined // fetch-style Headers
  const value = (headers as Record<string, string | string[] | undefined>)[name] // Node: names are lower case
  return Array.isArray(value) ? value[0] : value
}

/**
 * Verifies an Agoo webhook and returns the parsed event.
 * Pass the raw request body exactly as received, and every secret that is currently valid
 * (during a rotation, the new one and the old one).
 */
export function verifyAgooWebhook(
  rawBody: Uint8Array | string,
  headers: HeaderSource,
  secrets: string | string[],
  nowSeconds: number = Date.now() / 1000,
): AgooEvent {
  const id = readHeader(headers, "webhook-id")
  const timestamp = readHeader(headers, "webhook-timestamp")
  const signatureHeader = readHeader(headers, "webhook-signature")
  if (!id || !timestamp || !signatureHeader) {
    throw new WebhookVerificationError("Missing webhook-id, webhook-timestamp or webhook-signature")
  }
  if (!/^\d+$/.test(timestamp) || Math.abs(nowSeconds - Number(timestamp)) > TOLERANCE_SECONDS) {
    throw new WebhookVerificationError("Timestamp is more than 5 minutes from this server's clock")
  }

  const body = typeof rawBody === "string" ? Buffer.from(rawBody, "utf8") : Buffer.from(rawBody)
  for (const secret of Array.isArray(secrets) ? secrets : [secrets]) {
    const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64")
    const expected = createHmac("sha256", key).update(`${id}.${timestamp}.`).update(body).digest()
    for (const part of signatureHeader.split(" ")) {
      const [version, signature] = part.split(",", 2)
      if (version !== "v1" || !signature) continue
      const received = Buffer.from(signature, "base64")
      if (received.length === expected.length && timingSafeEqual(received, expected)) {
        return JSON.parse(body.toString("utf8")) as AgooEvent
      }
    }
  }
  throw new WebhookVerificationError("No signature matches")
}

import express from "express"
import { verifyAgooWebhook, WebhookVerificationError } from "./verify-agoo-webhook"

const app = express()
// The previous secret too, while you rotate: [process.env.AGOO_WEBHOOK_SECRET!, process.env.AGOO_WEBHOOK_SECRET_PREVIOUS!]
const secrets = [process.env.AGOO_WEBHOOK_SECRET!]

// express.raw keeps the body as the exact bytes Agoo signed. Register it on this route,
// and make sure no global express.json() runs before it.
app.post("/webhooks/agoo", express.raw({ type: "application/json" }), (req, res) => {
  let event
  try {
    event = verifyAgooWebhook(req.body, req.headers, secrets)
  } catch (err) {
    if (err instanceof WebhookVerificationError) return res.status(401).send(err.message)
    throw err
  }

  // Queue the event for processing, then acknowledge straight away
  console.log("Received", event.type, event.id)
  res.sendStatus(204)
})

app.listen(3000, () => console.log("Listening on http://localhost:3000"))

import { verifyAgooWebhook, WebhookVerificationError } from "@/lib/verify-agoo-webhook"

export const runtime = "nodejs" // node:crypto isn't available on the Edge runtime

const secrets = [process.env.AGOO_WEBHOOK_SECRET!]

export async function POST(request: Request) {
  const rawBody = new Uint8Array(await request.arrayBuffer())
  let event
  try {
    event = verifyAgooWebhook(rawBody, request.headers, secrets)
  } catch (err) {
    if (err instanceof WebhookVerificationError) return new Response(err.message, { status: 401 })
    throw err
  }

  // Queue the event for processing, then acknowledge straight away
  console.log("Received", event.type, event.id)
  return new Response(null, { status: 204 })
}