Verify webhook signatures

const encoder = new TextEncoder();

export async function verifySendmuxWebhook(request, secret) {
  const received = request.headers.get("X-Sendmux-Signature-V2") ?? "";
  const timestampHeader = request.headers.get("X-Sendmux-Timestamp") ?? "";
  const match = /^v1=([a-f0-9]{64})$/.exec(received);
  if (!match || !/^[0-9]{1,10}$/.test(timestampHeader)) return { ok: false };

  const timestamp = Number(timestampHeader);
  if (Math.abs(Math.floor(Date.now() / 1000) - timestamp) > 300) {
    return { ok: false };
  }

  const rawBody = new Uint8Array(await request.arrayBuffer());
  const prefix = encoder.encode(`${timestampHeader}.`);
  const signed = new Uint8Array(prefix.length + rawBody.length);
  signed.set(prefix);
  signed.set(rawBody, prefix.length);
  const signature = Uint8Array.from(match[1].match(/../g), (hex) =>
    Number.parseInt(hex, 16),
  );
  const key = await crypto.subtle.importKey(
    "raw",
    encoder.encode(secret),
    { name: "HMAC", hash: "SHA-256" },
    false,
    ["verify"],
  );
  if (!(await crypto.subtle.verify("HMAC", key, signature, signed))) {
    return { ok: false };
  }

  try {
    const body = JSON.parse(
      new TextDecoder("utf-8", { fatal: true }).decode(rawBody),
    );
    if (
      !body ||
      typeof body.id !== "string" ||
      typeof body.type !== "string" ||
      body.id !== request.headers.get("X-Sendmux-Event-Id") ||
      body.type !== request.headers.get("X-Sendmux-Event-Type")
    )
      return { ok: false };
    return { ok: true, body, eventId: body.id, eventType: body.type };
  } catch {
    return { ok: false };
  }
}