Verifikasi Signature

import crypto from "node:crypto";

const TOLERANCE_SECONDS = 5 * 60;

export function verifySimplusWebhook(rawBody, headers, secret) {
  const id = headers["svix-id"];
  const timestamp = headers["svix-timestamp"];
  const signatureHeader = headers["svix-signature"];
  if (!id || !timestamp || !signatureHeader) {
    throw new Error("Header webhook tidak lengkap");
  }

  // Tolak pesan yang terlalu lama atau dari masa depan
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - Number(timestamp)) > TOLERANCE_SECONDS) {
    throw new Error("Timestamp di luar toleransi");
  }

  // Key = bagian base64 setelah "whsec_"
  const key = Buffer.from(secret.split("_")[1], "base64");
  const expected = crypto
    .createHmac("sha256", key)
    .update(`${id}.${timestamp}.${rawBody}`)
    .digest();

  // Header bisa berisi beberapa "v1,<signature>" dipisahkan spasi
  const valid = signatureHeader.split(" ").some((entry) => {
    const [version, signature] = entry.split(",");
    if (version !== "v1" || !signature) return false;
    const received = Buffer.from(signature, "base64");
    return received.length === expected.length && crypto.timingSafeEqual(received, expected);
  });

  if (!valid) throw new Error("Signature tidak valid");
  return JSON.parse(rawBody);
}