import crypto from "node:crypto";

function verifyWebhookSignature(payload, signature, secret) {
  const elements = signature.split(",");
  const timestamp = elements.find((el) => el.startsWith("t="))?.split("=")[1];
  const v1 = elements.find((el) => el.startsWith("v1="))?.split("=")[1];

  if (!timestamp || !v1) return false;

  const payloadToSign = `${timestamp}.${payload}`;
  const expectedSignature = crypto
    .createHmac("sha256", secret)
    .update(payloadToSign, "utf8")
    .digest("hex");

  // Convert both signatures to Buffer for constant time comparison
  const receivedSignatureBuffer = Buffer.from(v1, "hex");
  const expectedSignatureBuffer = Buffer.from(expectedSignature, "hex");

  // Ensure both buffers are the same length
  if (receivedSignatureBuffer.length !== expectedSignatureBuffer.length) {
    return false;
  }

  // Constant time comparison
  return crypto.timingSafeEqual(
    receivedSignatureBuffer,
    expectedSignatureBuffer
  );
}

// Ejemplo de uso en Express.js
app.post('/webhook', express.raw({type: 'application/json'}), (req, res) => {
  const signature = req.headers['trebol-signature'];
  const payload = req.body.toString();
  
  if (!verifyWebhookSignature(payload, signature, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }
  
  // Procesar webhook...
  res.status(200).send('OK');
});