Webhooks

import 'dotenv/config';
import express from "express";
import { jwtVerify } from "jose";

const app = express();

// Your webhook_secret
const webhook_secret = process.env.SECRET;

app.post("/webhook", express.raw({type: "application/json"}), async (req, res) => {
    const jwt = req.get('Tight-Verification');

    let payload;
    try {
        // Verify the JWT using the HMAC-SHA256 signing algorithm
        const jwtVerifyResult = await jwtVerify(jwt, webhook_secret, {algorithms: ["HS256"]});
        payload = jwtVerifyResult.payload;
    } catch (err) {
        return res.status(400).send(`JWT failed to verify: ${err.message}`);
    }
});

app.post("/webhook", express.raw({type: "application/json"}), async (req, res) => {
    // Validate the iat, i.e. make sure the webhook has not expired
    // Tight recommends a default tolerance of five minutes
    const TIME_TOLERANCE = (60 * 5);
    let timestamp = payload.iat;
    const now = Math.floor(Date.now() / 1000);
    if (now - timestamp >= TIME_TOLERANCE) {
        return res.status(400).send("Webhook expired")
    }
});

import { timingSafeEqual } from "node:crypto";
const { subtle } = globalThis.crypto;

app.post("/webhook", express.raw({type: "application/json"}), async (req, res) => {
    // Validate the webhook body hash
    const enc = new TextEncoder();
    const bodyDigest = await subtle.digest("SHA-256", req.body);
    const webhookHash = enc.encode(btoa(String.fromCharCode(...new Uint8Array(bodyDigest))));
    const claimHash = enc.encode(payload.request_body_sha256 as string);
    if (!timingSafeEqual(webhookHash, claimHash)) {
        return res.status(400).send("Webhook payload modified")
    }


    // Verification succeeded
    // You can process the webhook here or call the next handler in your request-response cycle
    res.send("Webhook verification succeeded");
});