Webhooks

{
  "url": "https://example.com/hooks/xentree",
  "events": ["xel.module.completed", "organization.member.added"]
}

{
  "id": "…",
  "organization_id": "…",
  "url": "https://example.com/hooks/xentree",
  "events": ["organization.member.added", "xel.module.completed"],
  "status": "active",
  "disabled_reason": null,
  "consecutive_failures": 0,
  "secret_masked": "whsec_...a1b2",
  "previous_secret_valid_until": null,
  "created_at": "2026-10-13T10:00:00Z",
  "updated_at": "2026-10-13T10:00:00Z",
  "secret": "whsec_<64 hex characters>"
}

{
  "id": "evt_3f9c0d2e7a1b4c5d8e6f1a2b3c4d5e6f",
  "event": "xel.module.completed",
  "organization_id": "org_…",
  "created_at": "2026-10-13T10:15:30.123456Z",
  "data": { }
}

X-Xentree-Signature: t=<timestamp>,v1=<signature>

X-Xentree-Signature: t=1760350530,v1=<signed with new secret>,v1=<signed with old secret>

import { createHmac, timingSafeEqual } from "node:crypto";

const TOLERANCE_SECONDS = 300;

export function verifyXentreeSignature(
  rawBody: Buffer,
  header: string,
  secret: string,
): boolean {
  let timestamp: number | null = null;
  const candidates: string[] = [];

  for (const part of header.split(",")) {
    const idx = part.indexOf("=");
    if (idx < 0) return false;
    const key = part.slice(0, idx).trim();
    const value = part.slice(idx + 1).trim();
    if (key === "t" && timestamp === null) {
      timestamp = Number.parseInt(value, 10);
      if (Number.isNaN(timestamp)) return false;
    } else if (key === "v1") {
      candidates.push(value);
    }
  }
  if (timestamp === null || candidates.length === 0) return false;
  if (Math.abs(Date.now() / 1000 - timestamp) > TOLERANCE_SECONDS) return false;

  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.`)
    .update(rawBody)
    .digest("hex");
  const expectedBuf = Buffer.from(expected);

  let matched = false;
  for (const candidate of candidates) {
    const buf = Buffer.from(candidate);
    if (buf.length === expectedBuf.length && timingSafeEqual(buf, expectedBuf)) {
      matched = true; // keep looping so timing does not reveal which one matched
    }
  }
  return matched;
}