Security

import crypto from "crypto";
import { Request, Response } from "express";

/**
 * Validate HMAC signature of an incoming request.
 */
export function validateIncomingHmac(req: Request, secret: string): void {
  const signature = req.headers["x-signature"] as string;
  const timestamp = req.headers["x-timestamp"] as string;

  if (!signature || !timestamp) {
    throw new Error("Missing HMAC signature or timestamp in headers");
  }

  // Reject requests older than 5 minutes to prevent replay attacks
  if (Date.now() - parseInt(timestamp, 10) > 5 * 60 * 1000) {
    throw new Error("Request timestamp expired");
  }

  // Compute the expected signature
  const payload = JSON.stringify(req.body);
  const expectedSignature = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${payload}`)
    .digest("hex");

  if (signature !== expectedSignature) {
    throw new Error("Invalid HMAC signature");
  }
}

/**
 * Generate an HMAC signature for the response payload.
 */
export function signResponsePayload(payload: any, secret: string): string {
  return crypto
    .createHmac("sha256", secret)
    .update(JSON.stringify(payload))
    .digest("hex");
}

/**
 * Handles unexpected errors, logs them, signs the error response, and sends it.
 */
export function handleError(
  res: Response,
  error: any,
  sharedSecret: string
): void {
  console.error("Error processing request:", error.message || error);

  const responsePayload = { valid: false, message: "Server error" };
  const responseSignature = signResponsePayload(responsePayload, sharedSecret);

  res
    .status(500)
    .header("X-Response-Signature", responseSignature)
    .send(responsePayload);
}

import { Request as ExReq, Response as ExRes } from "express";
import {
  validateIncomingHmac,
  signResponsePayload,
  handleError,
} from "./utility-functions";

export default async (req: ExReq, res: ExRes) => {
  const sharedSecret = process.env.REPLYKE_WEBHOOKS_SECRET;

  try {
    const { projectId, type, data } = req.body;

    // Step 1: Validate the incoming HMAC signature
    validateIncomingHmac(req, sharedSecret!);

    // Step 2: Add your event-specific validation logic here
    switch (type) {
      case "user.created":
        console.log("Project ID:", projectId, "User data:", data);
        break;

      case "user.updated":
        console.log("Project ID:", projectId, "User update data:", data);
        break;

      case "entity.created":
        console.log("Project ID:", projectId, "Entity data:", data);
        break;

      case "entity.updated":
        console.log("Project ID:", projectId, "Entity update data:", data);
        break;

      case "notification.created":
        console.log("Project ID:", projectId, "Notification data:", data);
        break;
    }

    // Step 3: Send a valid response if the data is valid, or false if it is not valid. Include your secret
    const responsePayload = { valid: true };
    const responseSignature = signResponsePayload(
      responsePayload,
      sharedSecret!
    );

    res
      .status(200)
      .header("X-Response-Signature", responseSignature)
      .send(responsePayload);
  } catch (err) {
    handleError(res, err, sharedSecret!);
  }
};