Delivery

{
  "id": "5b1f6c1e-0000-4000-8000-000000000000",
  "eventType": "sync.events_available",
  "occurredAt": "2026-08-13T03:00:00.000Z",
  "organizationId": "org-example-id",
  "latestCursor": "456",
  "eventCount": 12,
  "entities": ["case", "document"]
}

import crypto from 'node:crypto';

function verifyWebhook(rawBody: string, headers: Headers, secret: string): boolean {
  const timestamp = headers.get('x-webhook-timestamp');
  const signature = headers.get('x-webhook-signature');
  if (!timestamp) return false;

  // Reject stale deliveries (replay protection).
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;

  // Strictly parse the header before comparing: timingSafeEqual THROWS on
  // length mismatch, and Buffer.from(x, 'hex') silently truncates at the
  // first invalid pair — so malformed input must be rejected here, not
  // passed through.
  const match = /^sha256=([0-9a-fA-F]{64})$/.exec(signature ?? '');
  if (!match) return false;

  const provided = Buffer.from(match[1], 'hex');
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest();
  return (
    provided.length === expected.length &&
    crypto.timingSafeEqual(provided, expected)
  );
}