Signatures

import { createHmac, timingSafeEqual } from "crypto";

// rawBody must be the exact bytes received (Buffer), not re-serialized JSON.
export function verifyBospaySignature({ secret, timestamp, signature, rawBody }) {
  if (!timestamp || !/^\d+$/.test(timestamp) || !signature) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 5 * 60) return false;
  const expected = Buffer.from(
    "sha256=" +
      createHmac("sha256", secret)
        .update(`${timestamp}.`)
        .update(rawBody)
        .digest("hex"),
  );
  // During a secret rotation the header holds one value per valid secret.
  return signature.split(",").some((candidate) => {
    const provided = Buffer.from(candidate.trim());
    return provided.length === expected.length && timingSafeEqual(provided, expected);
  });
}

const response = await fetch(`${process.env.BOSPAY_API_BASE}/webhooks/we_example/rotate-secret`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "BOSPay-Version": "2026-09-23",
    "X-API-Key": process.env.BOSPAY_API_KEY,
  },
  body: JSON.stringify({
    "expiresPreviousSecretInHours": 24
  })
});
if (!response.ok) {
  throw new Error(`BOSPay request failed: ${response.status}`);
}
const data = await response.json();