Webhooks

{
  "id": "evt_01HXM...",
  "type": "delivered",
  "project_id": "prj_01HXM...",
  "broadcast_id": "bdc_01HXM...",
  "subscriber_id": "sub_01HXM...",
  "external_id": "user_42",
  "meta": null,
  "created_at": 1716762345123
}

Content-Type:         application/json
User-Agent:           LitePush-Webhook/1
LitePush-Signature:   t=1716762345123,v1=a3f9c2d1...
LitePush-Event-Type:  delivered
LitePush-Event-Id:    evt_01HXM...

import { createHmac, timingSafeEqual } from "node:crypto";

const SECRET = process.env.LITEPUSH_WEBHOOK_SECRET!;
const TOLERANCE_MS = 5 * 60_000;

function verify(rawBody: string, header: string | null): boolean {
  if (!header) return false;

  // Header format: "t=<ms>,v1=<hex>"
  const parts = Object.fromEntries(
    header.split(",").map((kv) => kv.split("=") as [string, string])
  );
  const t = Number(parts.t);
  const v1 = parts.v1;
  if (!t || !v1) return false;

  // Reject replays older than 5 minutes.
  if (Math.abs(Date.now() - t) > TOLERANCE_MS) return false;

  const expected = createHmac("sha256", SECRET)
    .update(`${t}.${rawBody}`)
    .digest("hex");

  // Constant-time compare — NEVER use === here.
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(v1, "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}

async function verify(rawBody: string, header: string | null, secret: string) {
  if (!header) return false;
  const parts = Object.fromEntries(
    header.split(",").map((kv) => kv.split("=") as [string, string])
  );
  const t = Number(parts.t);
  const v1 = parts.v1;
  if (!t || !v1) return false;
  if (Math.abs(Date.now() - t) > 5 * 60_000) return false;

  const key = await crypto.subtle.importKey(
    "raw",
    new TextEncoder().encode(secret),
    { name: "HMAC", hash: "SHA-256" },
    false,
    ["sign"],
  );
  const sigBuf = await crypto.subtle.sign(
    "HMAC",
    key,
    new TextEncoder().encode(`${t}.${rawBody}`),
  );
  const expected = [...new Uint8Array(sigBuf)]
    .map((b) => b.toString(16).padStart(2, "0"))
    .join("");

  if (expected.length !== v1.length) return false;
  let diff = 0;
  for (let i = 0; i < expected.length; i++) {
    diff |= expected.charCodeAt(i) ^ v1.charCodeAt(i);
  }
  return diff === 0;
}

// Hono on Cloudflare Workers
app.post("/webhooks/litepush", async (c) => {
  // CRITICAL: read the raw body, not parsed JSON. The signature was
  // computed over the exact bytes we sent — parsing then re-serialising
  // changes whitespace and breaks the HMAC.
  const rawBody = await c.req.text();
  const sigHeader = c.req.header("LitePush-Signature");

  if (!(await verify(rawBody, sigHeader, c.env.LITEPUSH_WEBHOOK_SECRET))) {
    return c.json({ error: "invalid signature" }, 401);
  }

  const event = JSON.parse(rawBody);

  // Idempotency: retries deliver the same event.id with a NEW signature
  // timestamp. Dedupe by event.id on your side.
  if (await alreadyProcessed(event.id)) {
    return c.json({ ok: true }); // ack so we stop retrying
  }
  await markProcessed(event.id);

  // ... your business logic ...

  // Return 200 fast — heavy work should be enqueued, not awaited inline.
  return c.json({ ok: true });
});