Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(rawBody, header, secret, toleranceSeconds = 300) {
  // A key can REPEAT: during a rotation the header carries one `v1=` per
  // active secret. Collect them into a list — `Object.fromEntries` here would
  // silently keep only the last, and reject every delivery signed by the other.
  const parts = {};
  for (const piece of header.split(",")) {
    const i = piece.indexOf("=");
    if (i < 0) continue;
    (parts[piece.slice(0, i).trim()] ??= []).push(piece.slice(i + 1).trim());
  }

  const t = Number(parts.t?.[0]);
  if (!Number.isFinite(t)) return false;
  // Both directions: a future timestamp is as suspect as an old one.
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > toleranceSeconds) return false;

  const want = Buffer.from(createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex"), "hex");
  // Any one matching is enough: you hold one secret, the header may carry two.
  return (parts.v1 ?? []).some((v) => {
    // timingSafeEqual throws on a length mismatch, so compare lengths first.
    const got = Buffer.from(v, "hex");
    return got.length === want.length && timingSafeEqual(got, want);
  });
}

{
  "answered": true,
  "connectedMs": 41200,
  "endedBy": "agent",
  "endReason": "voicemail_left",
  "error": null,
  "voicemail": { "detected": true, "confidence": 0.67, "signals": ["acoustic", "keyword"], "action": "leaveMessage" },
  "transfer": null,
  "direction": "outbound"
}