Receiving call outcomes

import crypto from "node:crypto";
import express from "express";

const app = express();
const WEBHOOK_SECRET = process.env.GROWDENTAL_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 300;

/**
 * Verify an X-GrowDental-Signature header against the raw request body.
 * Format: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, `${t}.${rawBody}`)>
 */
function verifyGrowDentalSignature(rawBody, signatureHeader, secret) {
  if (!signatureHeader || typeof signatureHeader !== "string") return false;

  const parts = {};
  for (const piece of signatureHeader.split(",")) {
    const idx = piece.indexOf("=");
    if (idx > 0) parts[piece.slice(0, idx).trim()] = piece.slice(idx + 1).trim();
  }

  const timestamp = Number.parseInt(parts.t ?? "", 10);
  const expected = parts.v1 ?? "";
  if (!Number.isFinite(timestamp) || !/^[0-9a-f]{64}$/.test(expected)) return false;

  // Replay protection: reject stale or future-dated deliveries.
  const nowSeconds = Math.floor(Date.now() / 1000);
  if (Math.abs(nowSeconds - timestamp) > TOLERANCE_SECONDS) return false;

  const computed = crypto
    .createHmac("sha256", secret)
    .update(`${parts.t}.`)
    .update(rawBody) // Buffer of the raw request bytes
    .digest("hex");

  // Constant-time comparison.
  const a = Buffer.from(computed, "hex");
  const b = Buffer.from(expected, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// express.raw() keeps req.body as a Buffer for this route only.
app.post(
  "/growdental/webhooks",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.header("X-GrowDental-Signature");
    if (!verifyGrowDentalSignature(req.body, signature, WEBHOOK_SECRET)) {
      return res.status(401).send("invalid signature");
    }

    const deliveryId = req.header("X-GrowDental-Delivery-Id");
    // TODO: skip if deliveryId was already processed (at-least-once delivery).

    const event = JSON.parse(req.body.toString("utf8"));
    switch (event.type) {
      case "call.completed":
        console.log(`Call ${event.data.call_id} -> ${event.data.outcome}`);
        break;
      case "call.recording.ready":
        console.log(`Recording ready for call ${event.data.call_id}`);
        break;
      case "call_request.completed":
        console.log(`Call request ${event.data.call_request_id} finished`);
        break;
    }

    // Acknowledge fast; do real work on a queue.
    res.status(204).end();
  }
);

app.listen(3000);