Validar a assinatura de um webhook
do Mercado Pago (x-signature)

 1  import { createHmac, timingSafeEqual } from 'node:crypto';
 2  
 3  export function verifyMercadoPagoWebhook(req, secret: string): boolean {
 4    const xSignature = req.header('x-signature') ?? '';
 5    const xRequestId = req.header('x-request-id') ?? '';
 6    const dataId = String(req.query['data.id'] ?? '').toLowerCase();
 7  
 8    const parts = Object.fromEntries(
 9      xSignature.split(',').map((p) => p.trim().split('=')),
10    );
11    const { ts, v1 } = parts;
12    if (!ts || !v1) return false;
13  
14    let manifest = '';
15    if (dataId) manifest += `id:${dataId};`;
16    if (xRequestId) manifest += `request-id:${xRequestId};`;
17    manifest += `ts:${ts};`;
18  
19    const expected = createHmac('sha256', secret).update(manifest).digest('hex');
20    const a = Buffer.from(expected);
21    const b = Buffer.from(v1);
22    if (a.length !== b.length || !timingSafeEqual(a, b)) return false;
23  
24    // Replay protection: reject a signed timestamp older than 5 minutes.
25    // Mercado Pago's example ts has 10 digits (seconds); accept seconds or milliseconds.
26    const tsMs = Number(ts) < 1e12 ? Number(ts) * 1000 : Number(ts);
27    return Math.abs(Date.now() - tsMs) <= 5 * 60 * 1000;
28  }