���ϴ��¼�

import crypto from "node:crypto";

function verify(rawBody, headers, secret) {
  const id = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  const supplied = headers["webhook-signature"];
  const timestampNumber = Number(timestamp);

  if (!id || !supplied || !Number.isInteger(timestampNumber)) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - timestampNumber) > 300) return false;
  if (!secret?.startsWith("whsec_")) return false;

  const key = Buffer.from(secret.slice(6), "base64");
  const message = Buffer.concat([
    Buffer.from(id + "." + timestamp + ".", "utf8"),
    rawBody
  ]);
  const expected = crypto.createHmac("sha256", key).update(message).digest();

  return supplied.trim().split(/\s+/).some((item) => {
    const comma = item.indexOf(",");
    if (comma < 1 || item.slice(0, comma) !== "v1") return false;

    try {
      const actual = Buffer.from(item.slice(comma + 1), "base64");
      return actual.length === expected.length &&
        crypto.timingSafeEqual(actual, expected);
    } catch {
      return false;
    }
  });
}