Verificação e segurança

import express from 'express';
import crypto from 'node:crypto';

function billingWebhookHmacValid(bodyUtf8, headerValue, secret) {
  if (!headerValue || !secret) return false;

  const computed = crypto.createHmac('sha256', secret).update(bodyUtf8, 'utf8').digest('hex');
  const left = Buffer.from(computed, 'utf8');
  const right = Buffer.from(String(headerValue).trim(), 'utf8');

  if (left.length !== right.length) return false;
  return crypto.timingSafeEqual(left, right);
}

const app = express();

app.post(
  '/webhooks/upag-billing',
  express.raw({ type: 'application/json' }),
  async (req, res) => {
    const bodyUtf8 = req.body.toString('utf8');
    const signatureHeader = req.headers['x-upag-signature'];
    const secret = process.env.UPAG_WEBHOOK_SIGNING_SECRET;

    if (!billingWebhookHmacValid(bodyUtf8, signatureHeader, secret)) {
      return res.status(401).send('assinatura inválida');
    }

    const payload = JSON.parse(bodyUtf8);
    await handleBillingWebhook(payload);
    return res.status(200).send('ok');
  },
);

async function handleBillingWebhook(payload) {
  const id = payload.data?.id;
  if (!id) return;

  const key = `${payload.event}:${id}`;
  if (await db.webhookDedupe.exists(key)) return;

  await dispatch(payload);
  await db.webhookDedupe.put(key);
}