Webhooks

import express from "express";
import crypto from "node:crypto";

const SECRET = process.env.OXINSIDER_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 300;

function verify(rawBody, signatureHeader, timestampHeader) {
  const ts = Number(timestampHeader);
  if (!Number.isFinite(ts)) return false;
  if (Math.abs(Date.now() / 1000 - ts) > TOLERANCE_SECONDS) return false;

  const expected =
    "v1=" +
    crypto
      .createHmac("sha256", SECRET)
      .update(`${timestampHeader}.${rawBody}`)
      .digest("hex");

  // The header may carry a comma-separated list; accept any match.
  return signatureHeader
    .split(",")
    .map((s) => s.trim())
    .some((candidate) => {
      const a = Buffer.from(candidate);
      const b = Buffer.from(expected);
      return a.length === b.length && crypto.timingSafeEqual(a, b);
    });
}

const app = express();

// Capture the raw body; do NOT use a JSON parser before verifying.
app.post(
  "/webhooks/0xinsider",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const rawBody = req.body.toString("utf8");
    const ok = verify(
      rawBody,
      req.get("x-0xinsider-signature") ?? "",
      req.get("x-0xinsider-timestamp") ?? ""
    );
    if (!ok) return res.status(400).send("bad signature");

    const event = JSON.parse(rawBody);
    // Dedupe on event.id, then ACK fast and process async.
    res.status(200).send("ok");
    handleEvent(event).catch(console.error);
  }
);