Webhooks

const crypto = require('crypto');

// Store used nonces (use Redis/DB in production)
const usedNonces = new Set();
const REPLAY_WINDOW = 300; // 5 minutes

function verifyWebhook(req, secret) {
  const body = req.body; // raw string body
  const signature = req.headers['x-sharecy-signature'];
  const timestamp = req.headers['x-sharecy-timestamp'];
  const nonce = req.headers['x-sharecy-nonce'];

  // 1. Check timestamp freshness
  const age = Math.abs(Math.floor(Date.now() / 1000) - parseInt(timestamp));
  if (age > REPLAY_WINDOW) {
    throw new Error('Webhook too old or too new');
  }

  // 2. Check nonce uniqueness (prevent replay)
  if (usedNonces.has(nonce)) {
    throw new Error('Nonce already used (replay attack)');
  }
  usedNonces.add(nonce);

  // 3. Verify HMAC signature
  const signaturePayload = timestamp + '.' + nonce + '.' + body;
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(signaturePayload)
    .digest('hex');

  if (!crypto.timingSafeEqual(
    Buffer.from(signature), Buffer.from(expected)
  )) {
    throw new Error('Invalid signature');
  }

  return JSON.parse(body);
}

// Verify with support for secret rotation
function verifyWithRotation(req, newSecret, oldSecret) {
  const signature = req.headers['x-sharecy-signature'];
  const prevSignature = req.headers['x-sharecy-signature-previous'];
  const timestamp = req.headers['x-sharecy-timestamp'];
  const nonce = req.headers['x-sharecy-nonce'];
  const body = req.body;

  const sigPayload = timestamp + '.' + nonce + '.' + body;

  // Try new secret first
  const expected = 'sha256=' + crypto
    .createHmac('sha256', newSecret)
    .update(sigPayload).digest('hex');

  if (crypto.timingSafeEqual(
    Buffer.from(signature), Buffer.from(expected)
  )) {
    return true; // Valid with new secret
  }

  // Fall back to old secret during grace period
  if (oldSecret) {
    const oldExpected = 'sha256=' + crypto
      .createHmac('sha256', oldSecret)
      .update(sigPayload).digest('hex');
    return crypto.timingSafeEqual(
      Buffer.from(signature), Buffer.from(oldExpected)
    );
  }

  return false;
}