HTTP Step

import { NextRequest, NextResponse } from "next/server";
import { createHmac, timingSafeEqual } from "node:crypto";

const novuSecretKey = process.env.NOVU_SECRET_KEY as string;

export async function POST(req: NextRequest) {
  const headers = Object.fromEntries(req.headers.entries());
  let body = {};
  try {
    body = await req.json();
  } catch {
    // GET requests usually don't have a body
  }

  const parts = headers["novu-signature"].split(",");
  const timestampPart = parts.find((p) => p.startsWith("t="));
  const signaturePart = parts.find((p) => p.startsWith("v1="));

  const timestamp = Number(timestampPart?.split("=")[1]);
  const providedSignature = signaturePart?.split("=")[1];

  // Verify the timestamp is not stale
  const currentTimestampTime = Date.now();
  const fiveMinutes = 5 * 60 * 1000;
  const providedTimestamp = timestamp;
  // If the timestamp is stale, return a 401 error
  if (currentTimestampTime - providedTimestamp > fiveMinutes) {
    return NextResponse.json({ error: "stale request" }, { status: 401 });
  }

  const generatedSignature = createHmac("sha256", novuSecretKey)
    .update(`${timestamp}.${JSON.stringify(body)}`)
    .digest("hex");

  // Verify the signature
  const providedBuf = Buffer.from(providedSignature, "hex");
  const generatedBuf = Buffer.from(generatedSignature, "hex");
  const valid =
    providedBuf.length === generatedBuf.length &&
    timingSafeEqual(generatedBuf, providedBuf);

  // If the signature is not valid, return a 401 error
  if (!valid) {
    return NextResponse.json({ error: "Not authorized" }, { status: 401 });
  }

  return NextResponse.json({ message: "Authorized" }, { status: 200 });
}