Function verifyWebhookSignature

server/src/integrations/zoom.ts:466–492

(
  payload: string,
  signature: string,
  timestamp: string
)

 * See: https://developers.zoom.us/docs/api/rest/webhook-reference/#verify-webhook-events
 */
export function verifyWebhookSignature(
  payload: string,
  signature: string,
  timestamp: string
): boolean {
  const webhookSecret = process.env.ZOOM_WEBHOOK_SECRET;
  if (!webhookSecret) {
    logger.error('ZOOM_WEBHOOK_SECRET not configured - rejecting webhook');
    return false;
  }

  const message = `v0:${timestamp}:${payload}`;
  const expectedSignature = 'v0=' + crypto
    .createHmac('sha256', webhookSecret)
    .update(message)
    .digest('hex');

  try {
    return crypto.timingSafeEqual(
      Buffer.from(signature),
      Buffer.from(expectedSignature)
    );
  } catch {
    // timingSafeEqual throws if buffers have different lengths
    return false;
  }
}