Webhooks

Content-Type: application/json
X-Hyperscaled-Event: payment.succeeded
X-Hyperscaled-Delivery: whd_...
X-Hyperscaled-Timestamp: 1750640000
X-Hyperscaled-Signature: t=1750640000,v1=9f86d081...

{
  "type": "payment.succeeded",
  "data": { "payment_id": "pay_...", "user_id": "usr_...", "stripe_payment_intent_id": "pi_..." },
  "timestamp": "2026-06-22T23:13:20+00:00"
}

import crypto from "node:crypto";

// Accepts one secret or a comma-separated list, so you can keep the old and
// new secret live at the same time while rotating.
const SECRETS = (process.env.HSC_WEBHOOK_SECRET ?? "")
  .split(",").map((s) => s.trim()).filter(Boolean);

export async function POST(req: Request) {
  const raw = await req.text();
  const header = req.headers.get("x-hyperscaled-signature") ?? "";

  // The header may carry SEVERAL v1= signatures during a secret rotation:
  //   t=1730000000,v1=<new>,v1=<previous>
  // Object.fromEntries would silently keep only the last one — collect them all.
  let ts = NaN;
  const signatures: string[] = [];
  for (const part of header.split(",")) {
    const eq = part.indexOf("=");
    if (eq === -1) continue;
    const key = part.slice(0, eq).trim();
    const value = part.slice(eq + 1).trim();
    if (key === "t") ts = Number(value);
    else if (key === "v1") signatures.push(value);
  }
  if (!Number.isFinite(ts) || signatures.length === 0) {
    return new Response("bad signature", { status: 400 });
  }

  // Reject stale deliveries (replay protection).
  if (Math.abs(Date.now() / 1000 - ts) > 300) return new Response("stale", { status: 400 });

  const ok = SECRETS.some((secret) => {
    const expected = crypto
      .createHmac("sha256", secret)
      .update(`${ts}.${raw}`)
      .digest("hex");
    // timingSafeEqual throws on a length mismatch — guard before comparing.
    return signatures.some(
      (sig) =>
        sig.length === expected.length &&
        crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)),
    );
  });
  if (!ok) return new Response("bad signature", { status: 400 });

  const event = JSON.parse(raw); // { type, data, timestamp }
  // ...handle event.type
  return new Response("ok");
}