Ship a receiver that survives production.

import { createHmac, timingSafeEqual } from "node:crypto";

const MAX_AGE_SECONDS = 300;

export function verifyMapplsWebhook(input: {
  rawBody: Buffer;
  headers: Record<string, string | undefined>;
  secret: string;
  nowSeconds?: number;
}) {
  const timestamp = input.headers["x-mappls-timestamp"] ?? "";
  const eventId = input.headers["x-mappls-event-id"] ?? "";
  const signature = input.headers["x-mappls-signature"] ?? "";
  const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);

  if (!/^\d{10}$/.test(timestamp) || Math.abs(now - Number(timestamp)) > MAX_AGE_SECONDS) {
    throw new Error("stale_webhook");
  }
  if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/.test(eventId)) {
    throw new Error("invalid_event_id");
  }
  if (!/^v1=[a-f0-9]{64}$/.test(signature)) throw new Error("invalid_signature");

  const expected = createHmac("sha256", input.secret)
    .update(`${timestamp}.${eventId}.`)
    .update(input.rawBody)
    .digest();
  const actual = Buffer.from(signature.slice(3), "hex");
  if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
    throw new Error("invalid_signature");
  }
  return JSON.parse(input.rawBody.toString("utf8"));
}

export function verificationResponse(secret: string, challengeId: string, nonce: string) {
  return `v1=${createHmac("sha256", secret)
    .update(`${challengeId}.${nonce}`)
    .digest("hex")}`;
}

// Commit event.id and your durable effect in one transaction.
// Return 2xx only after that transaction commits.