Control de precios para motores de reservas y grupos hoteleros.

import { createHmac, timingSafeEqual } from "node:crypto";

// Or let the official library do it: npm install standardwebhooks, then
// new Webhook(secret).verify(rawBody, headers) throws unless it checks out.
// rawBody: the request body exactly as it arrived, before JSON.parse.
// headers: the request headers, with Node's lower-case names.
// secret: your whole signing secret, whsec_ prefix included.
function verify(rawBody, headers, secret, toleranceSeconds = 300) {
  const id = headers["webhook-id"];
  const timestamp = Number(headers["webhook-timestamp"]);
  if (!id || !Number.isInteger(timestamp)) return false;
  if (Math.abs(Date.now() / 1000 - timestamp) > toleranceSeconds) return false;
  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = createHmac("sha256", key).update(`${id}.${timestamp}.${rawBody}`).digest();
  return String(headers["webhook-signature"] ?? "").split(" ").some((entry) => {
    const [version, signature = ""] = entry.split(",", 2);
    const given = Buffer.from(signature, "base64");
    return version === "v1" && given.length === expected.length && timingSafeEqual(given, expected);
  });
}