Verify requests from Tars

import crypto from "node:crypto"

// header: the X-Tars-Signature value, e.g. "t=1760885331000,v1=5d1f…"
// rawBody: the body exactly as received, before parsing
export function isFromTars({ header, method, pathWithQuery, rawBody, secret }) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")))
  if (Math.abs(Date.now() - Number(parts.t)) > 5 * 60 * 1000) return false
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${parts.t}\n${method}\n${pathWithQuery}\n${rawBody}`)
    .digest("hex")
  return [parts.v1, parts.v2].some(
    (sig) => sig?.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))
  )
}