Universal Webhooks: Delivery to Sheets, Slack & CRMs

// Verify Form2Lead HMAC-SHA256 Signature in Node.js / Express
import crypto from 'crypto';

export function verifyForm2LeadWebhook(rawBody, signatureHeader, secret) {
  // signatureHeader format: "t=1729267200,v1=abcdef0123456789..."
  const parts = Object.fromEntries(
    signatureHeader.split(',').map((part) => part.split('='))
  );
  const timestamp = parts.t;
  const signature = parts.v1;

  if (!timestamp || !signature) return false;

  // Prevent replay attacks (reject payloads older than 5 minutes)
  const age = Math.floor(Date.now() / 1000) - parseInt(timestamp, 10);
  if (age > 300) return false;

  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  );
}