Overview

import { Webhook } from "standardwebhooks";

const wh = new Webhook(process.env.WEBHOOK_SECRET!);

app.post(
  "/webhooks/pandabase",
  express.raw({ type: "application/json" }),
  (req, res) => {
    try {
      const event = wh.verify(req.body.toString(), req.headers as any);
      // event is the parsed JSON body, signature already verified

      switch (event.event) {
        case "PAYMENT_COMPLETED":
          console.log(`Payment completed for order ${event.data.order.id}`);
          break;
        case "PAYMENT_REFUNDED":
          console.log(`Refund issued for order ${event.data.order.id}`);
          break;
      }

      res.status(200).send("OK");
    } catch {
      res.status(401).send("Invalid signature");
    }
  },
);

import crypto from "node:crypto";

const TOLERANCE_MS = 5 * 60 * 1000;

function verifyWebhook(
  headers: Record<string, string>,
  rawBody: string,
  secret: string,
): boolean {
  const msgId = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  const signatureHeader = headers["webhook-signature"];
  if (!msgId || !timestamp || !signatureHeader) return false;

  // Webhook-Signature is a space-separated list of `vN,<base64>` entries.
  // We only need to match one.
  const signatures = signatureHeader
    .split(" ")
    .filter((s) => s.startsWith("v1,"))
    .map((s) => s.slice(3));

  const signedPayload = `${msgId}.${timestamp}.${rawBody}`;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(signedPayload)
    .digest("base64");

  const valid = signatures.some(
    (sig) =>
      sig.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)),
  );
  if (!valid) return false;

  const skewMs = Math.abs(Date.now() - Number(timestamp) * 1000);
  return skewMs <= TOLERANCE_MS;
}