Webhook Signatures

import crypto from 'crypto';

function verify(req, secret) {
  const sigHeader = req.headers['medera-signature'];
  if (!sigHeader || !sigHeader.startsWith('sha256=')) return false;
  const sig = sigHeader.slice('sha256='.length);
  const body = req.rawBody;
  const expected = crypto.createHmac('sha256', secret).update(body).digest('hex');
  try {
    return crypto.timingSafeEqual(
      Buffer.from(sig, 'hex'),
      Buffer.from(expected, 'hex'),
    );
  } catch (e) {
    return false;
  }
}