ابنِ على Naavra بأمان

// Verify an Naavra webhook (Node.js)
import crypto from "node:crypto";

export function verify(rawBody, header, secret) {
  const [t, sig] = header.split(",").map(p => p.split("=")[1]);
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false; // stale
  const mac = crypto.createHmac("sha256", secret)
                    .update(`${t}.${rawBody}`).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(mac), Buffer.from(sig));
}