Verifying webhooks, websockets and callback requests

import crypto from "crypto"
import { Buffer } from "buffer";

export const verifyRequestFromRecall = (args: {
    // Workspace verification or Svix webhook secret                             
    secret: string,
    // Incoming request header
    headers: Record<string, string>,
    // Incoming raw request payload (if present). Use null if not applicable (e.g. GET or UPGRADE requests)
    payload: string | null,
}) => {
    const { secret, headers, payload } = args;
    const msgId = headers["webhook-id"] ?? headers["svix-id"];
    const msgTimestamp = headers["webhook-timestamp"] ?? headers["svix-timestamp"];
    const msgSignature = headers["webhook-signature"] ?? headers["svix-signature"];

    if (!secret || !secret.startsWith("whsec_")) {
        throw new Error(`Verification secret (${secret}is missing or invalid`);
    }
    if (!msgId || !msgTimestamp || !msgSignature) {
        throw new Error(`Missing webhook ID (${msgId}), timestamp (${msgTimestamp}), or signature (${msgSignature})`);
    }

    // Create the expected signature
    const prefix = "whsec_";
    const base64Part = secret.startsWith(prefix) ? secret.slice(prefix.length) : secret;
    const key = Buffer.from(base64Part, "base64");

    let payloadStr = '';
    if (payload) {
        if (Buffer.isBuffer(payload)) {
            payloadStr = payload.toString("utf8");
        } else if (typeof payload === 'string') {
            payloadStr = payload;
        }
    }

    const toSign = `${msgId}.${msgTimestamp}.${payloadStr}`;
    const expectedSig = crypto
        .createHmac("sha256", key)
        .update(toSign)
        .digest("base64");

    // Compare the expected signature to the signatures passed in the header
    const passedSigs = msgSignature.split(" ")
    for (const versionedSig of passedSigs) {
        const [version, signature] = versionedSig.split(",")
        if (version != "v1") {
            continue
        }
        const sigBytes = Buffer.from(signature, 'base64')
        const expectedSigBytes = Buffer.from(expectedSig, 'base64')
        if (expectedSigBytes.length === sigBytes.length && crypto.timingSafeEqual(new Uint8Array(expectedSigBytes), new Uint8Array(sigBytes))) {
            return
        }
    }

    // If no matching signature is found, throw an error
    throw new Error("No matching signature found");
}

import http from "http";
import { WebSocketServer } from "ws";
import { env } from "./config/env";
import { verifyRequestFromRecall } from "./verify-request-from-recall";

const server = http.createServer();

/**
 * HTTP server for handling HTTP requests from Recall.ai
 */
server.on("request", async (req, res) => {
    try {
        // Get request headers
        const headers = Object.fromEntries(
            Object.entries(req.headers)
                .map(([key, value]) => [
                    key.toLowerCase(),
                    typeof value === "string" ? value : value?.join(",") ?? ''
                ])
        )

        switch (req.method) {
            // Verify GET requests which don't have a body/payload
            case "GET": {
                verifyRequestFromRecall({
                    secret: env.VERIFICATION_SECRET,
                    headers,
                    payload: null,
                });

                break;
            }
            // Verify requests which have a body/payload
            case "POST": {
                // Must be the raw body from the request
                const bodyChunks: Buffer[] = [];
                for await (const chunk of req) {
                    bodyChunks.push(chunk);
                }
                const rawBody = Buffer.concat(bodyChunks).toString("utf-8");

                verifyRequestFromRecall({
                    secret: env.VERIFICATION_SECRET,
                    headers,
                    payload: rawBody,
                });

                break;
            }
            default: {
                throw new Error(`Method not allowed: ${req.method}`);
            }
        }

        console.log(`HTTP request verified: ${req.method} ${req.url}`);
        res.writeHead(200, { "Content-Type": "text/plain" });
        res.end("HTTP request verified");
    } catch (error) {
        console.error(`Error verifying HTTP request from Recall.ai: ${req.method} ${req.url}`, error);
        res.writeHead(400, { "Content-Type": "text/plain" });
        res.end("Request not verified");
    }
});

/**
 * Start the server
 */
server.listen(env.PORT, "0.0.0.0", () => {
    console.log(`Server is running on port ${env.PORT}`);
});

import http from "http";
import { WebSocketServer } from "ws";
import { env } from "./config/env";
import { verifyRequestFromRecall } from "./verify-request-from-recall";

const server = http.createServer();

/**
 * WebSocket server for handling WebSocket requests from Recall.ai
 */
const wss = new WebSocketServer({ noServer: true });
wss.on("connection", (socket) => {
    socket.on("message", rawMsg => {
        console.log("Message received", rawMsg.toString());
    });

    socket.on("close", () => {
        console.log("Socket closed");
    });
});

server.on("upgrade", (req, socket, head) => {
    try {
        const headers = Object.fromEntries(
            Object.entries(req.headers)
                .map(([key, value]) => [key.toLowerCase(), typeof value === "string" ? value : value?.join(",") ?? ''])
        )

        // Verify WebSocket requests on upgrade
        verifyRequestFromRecall({
            secret: env.VERIFICATION_SECRET,
            headers,
            payload: null,
        });

        wss.handleUpgrade(req, socket, head, (ws) => {
            wss.emit("connection", ws, req);
        });

        console.log(`WebSocket request verified: ${req.method} ${req.url}`);
        socket.write("WebSocket connection upgraded");
    } catch (error) {
        console.error(`Error verifying WebSocket request from Recall.ai: ${req.method} ${req.url}`, error);
        socket.destroy();
    }
});

/**
 * Start the server
 */
server.listen(env.PORT, "0.0.0.0", () => {
    console.log(`Server is running on port ${env.PORT}`);
});