Testing locally

import crypto from 'node:crypto';
import http from 'node:http';

const SECRET = process.env.RUNCRATE_WEBHOOK_SECRET; // whsec_...

function verify(rawBody, header) {
  const parts = (header ?? '').split(',').map(item => item.trim().split('='));
  const t = parts.find(([key]) => key === 't')?.[1];
  const signatures = parts.filter(([key, value]) => key === 'v1' && /^[0-9a-f]{64}$/.test(value ?? '')).map(([, value]) => value);
  if (!/^\d+$/.test(t ?? '') || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
  const expected = crypto.createHmac('sha256', SECRET).update(`${t}.`).update(rawBody).digest();
  return signatures.some(sig => crypto.timingSafeEqual(expected, Buffer.from(sig, 'hex')));
}

http
  .createServer((req, res) => {
    const chunks = [];
    req.on('data', chunk => chunks.push(chunk));
    req.on('end', () => {
      const rawBody = Buffer.concat(chunks);
      if (!SECRET || !verify(rawBody, req.headers['runcrate-signature'])) {
        res.writeHead(400).end('bad signature');
        console.log('Rejected a request with a bad signature');
        return;
      }
      res.writeHead(200).end();
      const event = JSON.parse(rawBody.toString('utf8'));
      console.log(req.headers['runcrate-event'], req.headers['runcrate-delivery'], JSON.stringify(event.data, null, 2));
    });
  })
  .listen(3000, () => console.log('Listening on http://localhost:3000'));