Webhook security

# Private key: keep it on your server, never share it
openssl genrsa -out tapipay-webhooks-private.pem 2048

# Public key: this is the one you provide to TapiPay
openssl rsa -in tapipay-webhooks-private.pem -pubout -out tapipay-webhooks-public.pem

import crypto from "node:crypto";
import express from "express";

const app = express();
const PRIVATE_KEY = process.env.TAPI_WEBHOOK_PRIVATE_KEY;
const CLIENT_USERNAME = process.env.TAPI_CLIENT_USERNAME;

function validHeader(value, expected) {
  if (!value) return false;
  const a = Buffer.from(value);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

function validHash(notification) {
  if (!notification.hash) return false;
  try {
    const content = crypto
      .privateDecrypt(
        { key: PRIVATE_KEY, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha1" },
        Buffer.from(notification.hash, "hex"),
      )
      .toString("utf8");
    const { clientUsername, operationId } = JSON.parse(content);
    // In orders and payment method registered it is `id`; in bank debit and card, `operationId`
    const identifier = notification.id ?? notification.operationId;
    return clientUsername === CLIENT_USERNAME && operationId === identifier;
  } catch {
    return false;
  }
}

app.post("/tapi/webhooks", express.json(), (req, res) => {
  // 1. Validate the origin before processing
  if (!validHeader(req.header("x-api-key"), process.env.TAPI_WEBHOOK_KEY) || !validHash(req.body)) {
    return res.sendStatus(401);
  }

  // 2. Answer quickly and process afterwards
  res.sendStatus(200);
  enqueue(req.body);
});