Function verifyLoopsSignature

apps/sim/lib/webhooks/providers/loops.ts:26–58

* Verify a Loops webhook signature. * Loops uses a Svix-compatible signing scheme (its own implementation, not Svix-hosted): * HMAC-SHA256 of `${webhookId}.${timestamp}.${body}` signed with the base64-decoded signing * secret (provided as `prefix_base64string`). Delivery metadata arrives in the `

(
  secret: string,
  webhookId: string,
  timestamp: string,
  signatureHeader: string,
  rawBody: string
)

 * @see https://loops.so/docs/webhooks
 */
function verifyLoopsSignature(
  secret: string,
  webhookId: string,
  timestamp: string,
  signatureHeader: string,
  rawBody: string
): boolean {
  try {
    const ts = Number.parseInt(timestamp, 10)
    const now = Math.floor(Date.now() / 1000)
    if (Number.isNaN(ts) || Math.abs(now - ts) > LOOPS_WEBHOOK_TIMESTAMP_SKEW_SECONDS) {
      return false
    }

    const base64Secret = secret.includes('_') ? secret.slice(secret.indexOf('_') + 1) : secret
    const secretBytes = Buffer.from(base64Secret, 'base64')
    const toSign = `${webhookId}.${timestamp}.${rawBody}`
    const expectedSignature = hmacSha256Base64(toSign, secretBytes)

    const providedSignatures = signatureHeader.split(' ')
    for (const versionedSig of providedSignatures) {
      const parts = versionedSig.split(',')
      const sig = parts.length === 2 ? parts[1] : versionedSig
      if (sig && safeCompare(sig, expectedSignature)) {
        return true
      }
    }
    return false
  } catch (error) {
    logger.error('Error verifying Loops signature:', error)
    return false
  }
}

export const loopsHandler: WebhookProviderHandler = {
  async verifyAuth({