Webhooks sicher empfangen

POST /v1/club/webhook-endpoints
Authorization: Bearer <token>
Idempotency-Key: 018f-create-webhook
Content-Type: application/json

{
  "name": "Primary event receiver",
  "url": "https://partner.example/webhooks/padel-lab",
  "event_types": ["booking.updated", "match.completed"]
}

import {createHmac, timingSafeEqual} from "node:crypto";

function verifyWebhook(
  timestamp: string | undefined,
  signature: string | undefined,
  rawBody: Buffer,
  secret: string,
) {
  if (!timestamp || !signature) return false;
  const signed = Buffer.concat([
    Buffer.from(timestamp),
    Buffer.from("."),
    rawBody,
  ]);
  const expected = "v1=" + createHmac("sha256", secret)
    .update(signed)
    .digest("hex");
  const expectedBytes = Buffer.from(expected);
  const signatureBytes = Buffer.from(signature);
  const sentAt = /^\d{10}$/.test(timestamp) ? Number(timestamp) * 1000 : NaN;
  const fresh = Number.isSafeInteger(sentAt) && Math.abs(Date.now() - sentAt) <= 300_000;
  return fresh &&
    signatureBytes.length === expectedBytes.length &&
    timingSafeEqual(expectedBytes, signatureBytes);
}