Webhook Verification

## Verifying Webhook Signatures

Every webhook Novacrust sends to your configured `webhookUrl` includes an `X-Novacrust-Signature` and `X-Novacrust-Timestamp` header, computed with the webhook secret shown in your Dashboard under **Settings → Webhooks**.

The signature is an HMAC-SHA256 of `{timestamp}.{raw JSON body}`, keyed with your webhook secret, and sent as `sha256={hex digest}`. Always verify a delivery before trusting its payload, and use the raw request body exactly as received — re-serializing after JSON parsing can alter key ordering or whitespace and produce a signature mismatch.
const crypto = require('crypto');

function isValidNovacrustWebhook(rawBody, headers, webhookSecret) {
  const timestamp = headers['x-novacrust-timestamp'];
  const signatureHeader = headers['x-novacrust-signature']; // "sha256=..."

  if (!timestamp || !signatureHeader) return false;

  const expected = crypto
    .createHmac('sha256', webhookSecret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  const provided = signatureHeader.replace('sha256=', '');

  return crypto.timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(provided, 'hex'),
  );
}