hmac.ts

import { createHmac, timingSafeEqual } from 'node:crypto';

export const DEMO_PARTNER_SECRET = 'demo-partner-secret';

export function partnerSecret(): string {
  return process.env.PARTNER_HMAC_SECRET || DEMO_PARTNER_SECRET;
}

export function signBody(body: string, secret: string = partnerSecret()): string {
  const digest = createHmac('sha256', secret).update(body).digest('hex');
  return `sha256=${digest}`;
}

export function verifySignature(
  body: string,
  signature: string | null | undefined,
  secret: string = partnerSecret(),
): boolean {
  if (!signature) return false;
  const expected = signBody(body, secret);
  if (signature.length !== expected.length) return false;
  try {
    return timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  } catch {
    return false;
  }
}