Connect a Next.js website

import { createHmac, timingSafeEqual } from 'node:crypto';

const TOLERANCE_SECONDS = 300; // reject requests older than 5 minutes

// rawBody: the request body exactly as received (a Buffer), before JSON.parse
export function verifySignature(rawBody, header, secret) {
  if (typeof header !== 'string') return false;
  const parts = Object.fromEntries(
    header.split(',').map((part) => part.trim().split('=', 2)),
  );
  const t = Number(parts.t);
  if (!Number.isInteger(t) || !/^[0-9a-f]{64}$/.test(parts.v1 ?? '')) return false;
  if (Math.abs(Date.now() / 1000 - t) > TOLERANCE_SECONDS) return false;

  const expected = createHmac('sha256', secret)
    .update(`${t}.`)
    .update(rawBody)
    .digest();
  const received = Buffer.from(parts.v1, 'hex');
  return received.length === expected.length && timingSafeEqual(received, expected);
}

import { verifySignature } from './verify';
import { savePost } from '@/lib/posts'; // your own code: create or update the post

export const runtime = 'nodejs'; // node:crypto is needed for the signature

export async function POST(request: Request) {
  // Read the raw body first: the signature is made over these exact bytes.
  const raw = Buffer.from(await request.arrayBuffer());
  const signature = request.headers.get('x-seo-autopilot-signature');
  if (!verifySignature(raw, signature, process.env.WEBHOOK_SIGNING_SECRET)) {
    return new Response(null, { status: 401 });
  }
  const body = JSON.parse(raw.toString('utf8'));

  if (body.event === 'ping') {
    return Response.json({ ok: true });
  }
  if (body.event === 'article.publish') {
    // body.article.externalId is set when we update an article you published before.
    const post = await savePost(body.article);
    return Response.json({ id: String(post.id), url: post.url });
  }
  return new Response(null, { status: 400 });
}