timingSafeEqual

import {timingSafeEqual} from "attio/server"

export default async function webhookHandler(request: Request) {
  const body = await request.text()
  const signature = request.headers.get("x-signature") ?? ""

  const key = await crypto.subtle.importKey(
    "raw",
    new TextEncoder().encode(process.env.WEBHOOK_SECRET),
    {name: "HMAC", hash: "SHA-256"},
    false,
    ["sign"],
  )
  const expected = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(body))
  const received = Uint8Array.from(atob(signature), (char) => char.charCodeAt(0))

  if (received.byteLength !== expected.byteLength || !timingSafeEqual(received, expected)) {
    return new Response("Invalid signature", {status: 401})
  }

  return new Response(null, {status: 200})
}