Function verifySvixSignature

apps/sim/lib/webhooks/providers/clerk.ts:21–53

* Verify a Clerk webhook signature using the Svix signing scheme. * Clerk uses Svix under the hood: HMAC-SHA256 of `${svix-id}.${svix-timestamp}.${body}` * signed with the base64-decoded `whsec_...` secret, compared against the * space-delimited, versioned (`v1, `) `svix-signature` header.

(
  secret: string,
  msgId: string,
  timestamp: string,
  signatures: string,
  rawBody: string
)

 * space-delimited, versioned (`v1,<sig>`) `svix-signature` header.
 */
function verifySvixSignature(
  secret: string,
  msgId: string,
  timestamp: string,
  signatures: string,
  rawBody: string
): boolean {
  try {
    const ts = Number.parseInt(timestamp, 10)
    const now = Math.floor(Date.now() / 1000)
    if (Number.isNaN(ts) || Math.abs(now - ts) > 5 * 60) {
      return false
    }

    const secretBytes = Buffer.from(secret.replace(/^whsec_/, ''), 'base64')
    const toSign = `${msgId}.${timestamp}.${rawBody}`
    const expectedSignature = hmacSha256Base64(toSign, secretBytes)

    const providedSignatures = signatures.split(' ')
    for (const versionedSig of providedSignatures) {
      const parts = versionedSig.split(',')
      if (parts.length !== 2) continue
      const sig = parts[1]
      if (safeCompare(sig, expectedSignature)) {
        return true
      }
    }
    return false
  } catch (error) {
    logger.error('Error verifying Clerk Svix signature:', error)
    return false
  }
}

export const clerkHandler: WebhookProviderHandler = {
  async verifyAuth({