Verify webhook signatures

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyWebhook(rawBody, signature, secrets, now = Date.now()) {
  if (!Buffer.isBuffer(rawBody) || typeof signature !== 'string') return false;
  const parts = signature.split(',').map(value => value.trim());
  const timestamps = parts.filter(value => value.startsWith('t='));
  if (timestamps.length !== 1 || !/^t=\d+$/.test(timestamps[0])) return false;
  const timestamp = timestamps[0].slice(2);
  const seconds = Number(timestamp);
  if (!Number.isSafeInteger(seconds) || Math.abs(now / 1000 - seconds) > 300) return false;
  const candidates = parts.filter(value => /^v1=[0-9a-f]{64}$/.test(value))
    .map(value => Buffer.from(value.slice(3), 'hex'));
  return secrets.some(secret => {
    const expected = createHmac('sha256', secret)
      .update(timestamp + '.').update(rawBody).digest();
    return candidates.some(candidate => timingSafeEqual(candidate, expected));
  });
}