Bibliotheken

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyRyhSignature(rawBody: string, header: string, secret: string): boolean {
  // Header-Format: t=<unix-sekunden>,v1=<hex-signatur>
  const parts = Object.fromEntries(header.split(",").map((entry) => entry.split("=")));
  const expected = createHmac("sha256", secret).update(`${parts.t}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(parts.v1 ?? "");
  if (a.length !== b.length) return false;
  // Zeitfenster von fünf Minuten gegen Wiedereinspielung
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false;
  return timingSafeEqual(a, b);
}

const RETRYABLE = new Set(["rate_limited", "internal"]);

export async function callWithRetry<T>(run: () => Promise<T>, attempts = 4): Promise<T> {
  let lastError: unknown;
  for (let attempt = 0; attempt < attempts; attempt += 1) {
    try {
      return await run();
    } catch (error) {
      lastError = error;
      const code = (error as { code?: string }).code ?? "";
      if (!RETRYABLE.has(code)) throw error;
      // Wartezeit verdoppeln, mit kleiner Streuung gegen Lastspitzen
      const wait = 2 ** attempt * 500 + Math.random() * 250;
      await new Promise((resolve) => setTimeout(resolve, wait));
    }
  }
  throw lastError;
}