Dead Letter Webhook Recovery Proxy

const crypto = require('crypto');

/**
 * Verifies the signature of a webhook payload sent by Dead Letter.
 * 
 * @param {string|object} payload - The raw request body string or parsed JSON object.
 * @param {string} signature - The signature from the 'x-dead-letter-signature' header.
 * @param {string} secretKey - The endpoint's HMAC Secret Key.
 * @returns {boolean} - True if signature is valid, false otherwise.
 */
function verifySignature(payload, signature, secretKey) {
  const payloadString = typeof payload === 'string' 
    ? payload 
    : JSON.stringify(payload);
    
  const computedSignature = crypto
    .createHmac('sha256', secretKey)
    .update(payloadString)
    .digest('hex');

  // Prevent timing attacks using timingSafeEqual
  const signatureBuffer = Buffer.from(signature, 'hex');
  const computedBuffer = Buffer.from(computedSignature, 'hex');

  if (signatureBuffer.length !== computedBuffer.length) {
    return false;
  }

  return crypto.timingSafeEqual(signatureBuffer, computedBuffer);
}