Webhook Subscriptions & Cryptographic Signatures

import crypto from 'crypto';

export function verifyKommifyWebhook(payload, signatureHeader, secret) {
  const [timestamp, signature] = signatureHeader.split(',');
  const signedPayload = `${timestamp}.${payload}`;
  
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');
    
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}