Function verifyIncidentioSignature

apps/sim/lib/webhooks/providers/incidentio.ts:25–57

* Verify an incident.io webhook signature using the Svix signing scheme. * incident.io webhooks are powered by Svix: HMAC-SHA256 of * `${webhook-id}.${webhook-timestamp}.${body}` signed with the base64-decoded * `whsec_...` secret, compared against the `webhook-signature` header which may * carr

(
  secret: string,
  msgId: string,
  timestamp: string,
  signatures: string,
  rawBody: string
)

 * @see https://docs.incident.io/integrations/webhooks
 */
function verifyIncidentioSignature(
  secret: string,
  msgId: string,
  timestamp: string,
  signatures: string,
  rawBody: string
): boolean {
  try {
    const ts = Number.parseInt(timestamp, 10)
    const now = Math.floor(Date.now() / 1000)
    if (Number.isNaN(ts) || Math.abs(now - ts) > INCIDENTIO_WEBHOOK_TIMESTAMP_SKEW_SECONDS) {
      return false
    }

    const secretBytes = Buffer.from(secret.replace(/^whsec_/, ''), 'base64')
    const toSign = `${msgId}.${timestamp}.${rawBody}`
    const expectedSignature = hmacSha256Base64(toSign, secretBytes)

    const providedSignatures = signatures.split(' ')
    for (const versionedSig of providedSignatures) {
      const parts = versionedSig.split(',')
      if (parts.length !== 2) continue
      const sig = parts[1]
      if (safeCompare(sig, expectedSignature)) {
        return true
      }
    }
    return false
  } catch (error) {
    logger.error('Error verifying incident.io Svix signature:', error)
    return false
  }
}

function asObject(value: unknown): Record<string, unknown> | null {
  if (value && typeof value === 'object' && !Array.isArray(value)) {