Verifying signatures

X-Webhook-Signature: t=<unix_seconds>,v1=<hex_hmac_sha256>

import http from "node:http";
import crypto from "node:crypto";

const WEBHOOK_SECRET = process.env.TF_WEBHOOK_SECRET!;
const MAX_BODY_BYTES = 1_000_000; // 1MB — generous for these payloads
const seenKeys = new Set<string>(); // swap for a real store (Redis, Postgres) in production

function verify(secret: string, header: string, rawBody: Buffer): boolean {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2)));
  const t = parts.t;
  const v1 = parts.v1;
  if (!t || !v1) return false;
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false; // 5-minute window

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.`)
    .update(rawBody)
    .digest("hex");

  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(v1, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

const server = http.createServer((req, res) => {
  if (req.method !== "POST" || req.url !== "/webhooks/obsidian") {
    res.writeHead(404).end();
    return;
  }

  const chunks: Buffer[] = [];
  let size = 0;

  req.on("data", (chunk: Buffer) => {
    size += chunk.length;
    if (size > MAX_BODY_BYTES) {
      req.destroy(); // guard against an oversized body tying up the process
      return;
    }
    chunks.push(chunk);
  });

  req.on("end", () => {
    const rawBody = Buffer.concat(chunks);
    const signature = req.headers["x-webhook-signature"];

    if (typeof signature !== "string" || !verify(WEBHOOK_SECRET, signature, rawBody)) {
      res.writeHead(400, { "Content-Type": "text/plain" }).end("bad signature");
      return;
    }

    let event: any;
    try {
      event = JSON.parse(rawBody.toString("utf8"));
    } catch {
      res.writeHead(400, { "Content-Type": "text/plain" }).end("invalid json");
      return;
    }

    // Ack immediately — Obsidian's 15s timeout starts from connect, not from
    // when you finish business logic. Don't make the sender wait on your DB.
    res.writeHead(200, { "Content-Type": "application/json" }).end('{"ok":true}');

    // Idempotency: same key means a retry or a manual resend of an event
    // you've already seen. In production, back this with a persistent store
    // (unique constraint on idempotency_key), not an in-memory Set.
    const key = event.idempotency_key;
    if (key && seenKeys.has(key)) return;
    if (key) seenKeys.add(key);

    void processEvent(event).catch((err) => {
      console.error("webhook processing failed", key, err);
      // Route to your own retry/alerting path — Obsidian already got its 2xx.
    });
  });

  req.on("error", () => res.writeHead(400).end());
});

async function processEvent(event: any): Promise<void> {
  switch (event.event_type) {
    case "identity.kyc.session.approved":
      // event.vendor_data identifies your user
      break;
    case "identity.kyc.session.declined":
      break;
    case "identity.application.manual_review":
      // event.application.decision === "manual_review"
      break;
    default:
      // Unrecognised event_type — log and move on; don't throw.
      console.warn("unhandled event_type", event.event_type);
  }
}

server.listen(3000, () => console.log("listening on :3000"));

import express from "express";

const app = express();

app.post(
  "/webhooks/obsidian",
  express.raw({ type: "application/json" }),   // raw body — not express.json()
  (req, res) => {
    const sig = req.header("X-Webhook-Signature") ?? "";
    if (!verify(process.env.TF_WEBHOOK_SECRET!, sig, req.body)) {
      return res.status(400).send("bad signature");
    }

    const event = JSON.parse(req.body.toString("utf8"));
    res.status(200).end();                      // ack fast
    void queue.enqueue(event);                  // work later, deduped on idempotency_key
  },
);