Validando assinatura HMAC

import { createHmac, timingSafeEqual } from "node:crypto";
import { createServer } from "node:http";

const secret = process.env.GRANDEPAY_SECRET_KEY;

if (!secret) {
  throw new Error("Defina GRANDEPAY_SECRET_KEY no servidor.");
}

function readRawBody(req) {
  return new Promise((resolve, reject) => {
    const chunks = [];
    req.on("data", (chunk) => chunks.push(chunk));
    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
    req.on("error", reject);
  });
}

function signaturesMatch(received, expected) {
  const receivedBuffer = Buffer.from(received);
  const expectedBuffer = Buffer.from(expected);
  if (receivedBuffer.length !== expectedBuffer.length) {
    return false;
  }
  return timingSafeEqual(receivedBuffer, expectedBuffer);
}

createServer(async (req, res) => {
  const rawBody = await readRawBody(req);
  const header =
    req.headers["x-signature-256"] || req.headers["x-webhook-signature"] || "";
  const expected = createHmac("sha256", secret).update(rawBody, "utf8").digest("hex");

  if (!signaturesMatch(String(header), expected)) {
    res.writeHead(401);
    res.end();
    return;
  }

  res.writeHead(204);
  res.end();
}).listen(3001);