Verify a webhook signature

import crypto from 'node:crypto';// True when the call is signed with your secret and was sent less than five minutes ago.export function isValidSignature(rawBody, header, secret) {	const fields = Object.fromEntries(String(header).split(',').map(field => field.split('=')));	const fresh = Math.abs(Date.now() / 1000 - Number(fields.t)) < 300;	const expected = crypto.createHmac('sha256', secret).update(`${fields.t}.${rawBody}`).digest();	const received = Buffer.from(fields.v1 ?? '', 'hex');	return fresh && received.length === expected.length && crypto.timingSafeEqual(received, expected);}

import express from 'express';import { isValidSignature } from './zean-signature.js';const app = express();// The raw body: the signature covers the bytes as sent, before any JSON parsing.app.post('/zean/webhook', express.raw({ type: 'application/json' }), (req, res) => {	if (!isValidSignature(req.body, req.get('zean-signature'), process.env.ZEAN_WEBHOOK_SECRET)) {		return res.sendStatus(401);	}	const event = JSON.parse(req.body);	// Answer within 10 seconds, then do the long work.	res.sendStatus(200);	console.log(event.type, event.data.conversationId);});