Webhooks

{
  "config": {
    "webhook": {
      "url": "https://api.example.com/hooks/chmod"
    }
  }
}

import crypto from "node:crypto";
import { createRemoteJWKSet } from "jose";

const JWKS = createRemoteJWKSet(new URL(`${CHMOD_API_URL}/.well-known/jwks.json`));
const MAX_AGE_MS = 5 * 60 * 1000;

app.post("/hooks/chmod", express.json(), async (req, res) => {
  const timestamp = req.header("X-Timestamp");
  const signature = req.header("X-Signature");

  if (!timestamp || !signature) return res.sendStatus(401);

  // Reject stale calls: a valid signature never expires on its own.
  if (Math.abs(Date.now() - Date.parse(timestamp)) > MAX_AGE_MS) {
    return res.sendStatus(401);
  }

  const transactionId = req.body.transaction_id;
  const signedString  = `${timestamp}:${transactionId}`;

  const key = await JWKS({ alg: "RS256" }, null);
  const ok  = crypto.verify(
    "sha256",
    Buffer.from(signedString),
    key,
    Buffer.from(signature, "base64"),
  );

  if (!ok) return res.sendStatus(401);

  // Acknowledge immediately, then do the work out of band.
  res.sendStatus(200);
  await queue.enqueue({ transactionId });
});