Verify signatures

import { createHmac, timingSafeEqual } from "node:crypto";
import { createServer } from "node:http";

const token = process.env.BOTTARI_WEBHOOK_TOKEN;

function isValidSignature(rawBody, header, secret) {
  if (typeof header !== "string") return false;
  const expected = "sha256=" + createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(header);
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

createServer((req, res) => {
  const chunks = [];
  req.on("data", (chunk) => chunks.push(chunk));
  req.on("end", () => {
    const rawBody = Buffer.concat(chunks);

    // Verification step: enter the token in the app, then set the environment variable.
    if (!token) {
      console.log(rawBody.toString());
      res.writeHead(200).end();
      return;
    }

    if (!isValidSignature(rawBody, req.headers["x-notion-signature"], token)) {
      res.writeHead(401).end();
      return;
    }

    const event = JSON.parse(rawBody);
    console.log(event.id, event.type, event.entity.id);
    // Queue slow work and answer right away. You have 15 seconds to return a 2xx.
    res.writeHead(200).end();
  });
}).listen(3000);