Verify webhook signatures

const encoder = new TextEncoder();

function toHex(buffer) {
  return [...new Uint8Array(buffer)]
    .map((byte) => byte.toString(16).padStart(2, "0"))
    .join("");
}

function constantTimeEqual(a, b) {
  if (a.length !== b.length) return false;

  let result = 0;
  for (let i = 0; i < a.length; i += 1) {
    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
  }
  return result === 0;
}

export async function verifySendmuxWebhook(request, secret) {
  const rawBody = await request.text();
  const key = await crypto.subtle.importKey(
    "raw",
    encoder.encode(secret),
    { name: "HMAC", hash: "SHA-256" },
    false,
    ["sign"],
  );

  const digest = await crypto.subtle.sign("HMAC", key, encoder.encode(rawBody));
  const expected = `sha256=${toHex(digest)}`;
  const received = request.headers.get("X-Sendmux-Signature") ?? "";

  if (!constantTimeEqual(received, expected)) {
    return { ok: false };
  }

  return {
    ok: true,
    body: JSON.parse(rawBody),
    eventId: request.headers.get("X-Sendmux-Event-Id"),
    eventType: request.headers.get("X-Sendmux-Event-Type"),
  };
}