تكامل طلبات المطاعم

const crypto = require("crypto");

function verifySelaWebhook(rawBody, signature, timestamp, secret) {
    // 5-minute tolerance window for replay attacks
    const fiveMinutes = 5 * 60 * 1000;
    if (Math.abs(Date.now() - Number(timestamp)) > fiveMinutes) {
        throw new Error("Replay attack suspected: timestamp window exceeded.");
    }

    // Concatenate timestamp and raw body using a dot
    const signedPayload = `${timestamp}.${rawBody}`;
    
    // Compute HMAC-SHA256 in hex format
    const computed = crypto
        .createHmac("sha256", secret)
        .update(signedPayload)
        .digest("hex");

    // Perform timing-safe comparison to prevent side-channel leaks
    return crypto.timingSafeEqual(
        Buffer.from(signature, "hex"),
        Buffer.from(computed, "hex")
    );
}