إشعارات Webhook

import crypto from "node:crypto";
 
// Header: X-TravelCore-Signature: t=1756377600,v1=<hex>
export function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(
    header.split(",").map((kv) => kv.split("=")),
  );
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${parts.t}.${rawBody}`)
    .digest("hex");
 
  // Constant-time compare, and reject stale timestamps to stop replay.
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  const ok = crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(parts.v1),
  );
  return fresh && ok;
}