İmza Doğrulama

import crypto from "crypto";
import express from "express";

const app = express();

// IMPORTANT: imza için ham body gerekir, JSON parse edilmeden saklayın
app.use("/webhooks/payven", express.raw({ type: "application/json" }));

app.post("/webhooks/payven", (req, res) => {
  const signature = req.header("x-payven-signature");
  const timestamp = req.header("x-payven-timestamp");
  const body = req.body.toString("utf8");

  // 1. Timestamp 5 dakika içinde mi?
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp, 10)) > 300) {
    return res.status(401).send("Timestamp out of tolerance");
  }

  // 2. İmzayı hesapla
  const expected =
    "sha256=" +
    crypto
      .createHmac("sha256", process.env.PAYVEN_WEBHOOK_SECRET)
      .update(`${timestamp}.${body}`)
      .digest("hex");

  // 3. Sabit zamanlı karşılaştır
  const sigBuf = Buffer.from(signature ?? "", "utf8");
  const expBuf = Buffer.from(expected, "utf8");
  if (sigBuf.length !== expBuf.length || !crypto.timingSafeEqual(sigBuf, expBuf)) {
    return res.status(401).send("Invalid signature");
  }

  const event = JSON.parse(body);
  console.log("Verified event:", event.type, event.id);
  res.status(200).end();
});