Every flight off the board, delivered.

import { createHmac, timingSafeEqual } from 'node:crypto'

const TOLERANCE_SECONDS = 300

export function verify(rawBody: string, header: string, secret: string): boolean {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=', 2)))
  const timestamp = Number(parts.t)
  if (!Number.isFinite(timestamp)) return false

  // Bound the age first: the timestamp is inside the MAC, so an attacker
  // cannot backdate a captured request to keep replaying it.
  if (Math.abs(Date.now() / 1000 - timestamp) > TOLERANCE_SECONDS) return false

  const expected = createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex')

  const a = Buffer.from(parts.v1 ?? '')
  const b = Buffer.from(expected)
  return a.length === b.length && timingSafeEqual(a, b)
}

// Next.js route handler. Read the raw body — re-serialising the parsed
// JSON produces different bytes and the signature will not match.
export async function POST(request: Request) {
  const raw = await request.text()
  const header = request.headers.get('x-flight-signature') ?? ''

  if (!verify(raw, header, process.env.FLIGHT_WEBHOOK_SECRET!)) {
    return new Response('invalid signature', { status: 401 })
  }

  const event = JSON.parse(raw)

  // Acknowledge first, work after. We time out at 10s and
  // retry a non-2xx, so slow handlers turn into duplicate attempts.
  void enqueue(event)

  return new Response(null, { status: 204 })
}