Webhooks and signature verification

import crypto from "node:crypto";

// TravelDistro webhook: X-TD-Webhook-Signature = "sha256=" + HMAC-SHA256(`${timestamp}.${rawBody}`, endpointSecret)
export function verifyTravelDistroWebhook(headers: Record<string, string>, rawBody: string, endpointSecret: string): boolean {
  const timestamp = headers["x-td-webhook-timestamp"];
  const signature = headers["x-td-webhook-signature"] ?? "";
  if (!timestamp || Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false; // stale or replayed

  const expected = "sha256=" + crypto.createHmac("sha256", endpointSecret).update(`${timestamp}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && crypto.timingSafeEqual(a, b); // constant-time compare
}

// Deduplicate by X-TD-Webhook-Id: the same id is reused on every retry of one delivery.