Built to be debugged.

curl -X POST 'https://api.sendsend.email/v1/emails' \
  -H "Authorization: Bearer $SENDSEND_API_KEY" \
  -H 'Content-Type: application/json' \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
  "from": "Acme <hello@mail.example.com>",
  "to": [
    "delivered@example.com"
  ],
  "subject": "Welcome to Acme",
  "html": "<p>Thanks for signing up!</p>",
  "text": "Thanks for signing up!",
  "tags": {
    "application_reference": "signup_123"
  }
}'

const crypto = require("crypto");

// rawBody must be the exact request body string, before any JSON parsing.
function verifyWebhook(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = header.split(",").map((p) => p.trim().split("="));
  const t = Number(parts.find((p) => p[0] === "t")?.[1]);
  if (!Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;
  const expected = Buffer.from(
    crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex")
  );
  return parts
    .filter((p) => p[0] === "v1")
    .some((p) => {
      const got = Buffer.from(p[1] || "");
      return got.length === expected.length && crypto.timingSafeEqual(got, expected);
    });
}

// Express: app.post("/hook", express.raw({ type: "application/json" }), (req, res) => {
//   if (!verifyWebhook(req.body.toString(), req.get("SendSend-Signature"), process.env.SENDSEND_WEBHOOK_SECRET)) return res.sendStatus(400);
//   const event = JSON.parse(req.body); // deduplicate on event.id
//   res.sendStatus(200);
// });