Signature Verification

import crypto from 'node:crypto';
import express from 'express';

const SIGNING_SECRET = process.env.SMARTALEX_SIGNING_SECRET; // shs_...

function verifySignature(req) {
  const header = req.header('X-SmartAlex-Signature');
  if (!header) return false;

  const [tPart, v1Part] = header.split(',');
  const ts = tPart?.split('=')[1];
  const v1 = v1Part?.split('=')[1];
  if (!ts || !v1) return false;

  // Replay defense: reject signatures older than 5 minutes or
  // more than 1 minute in the future (clock skew tolerance).
  const ageSeconds = (Date.now() - parseInt(ts, 10)) / 1000;
  if (ageSeconds > 300 || ageSeconds < -60) return false;

  // Use raw request body bytes, not the JSON-stringified parsed object.
  const expected = crypto
    .createHmac('sha256', SIGNING_SECRET)
    .update(`${ts}.${req.rawBody}`)
    .digest('hex');

  // Constant-time compare. Lengths must match or timingSafeEqual throws.
  if (v1.length !== expected.length) return false;
  return crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}

const app = express();

// Capture raw body so we can HMAC the exact bytes that arrived.
app.use(express.json({
  verify: (req, _res, buf) => {
    req.rawBody = buf.toString('utf8');
  },
}));

app.post('/smartalex/lookup', (req, res) => {
  if (!verifySignature(req)) {
    return res.status(401).send('Invalid signature');
  }

  const { tool, arguments: args, call_id } = req.body;

  if (tool === 'lookup_routing') {
    const extension = lookupRouting(args.query);
    return res.json({
      extension,
      hint: `Transfer to extension ${extension}.`,
    });
  }

  res.status(404).send('Unknown tool');
});

app.listen(3000);