Firma HMAC-SHA256

const crypto = require("crypto");

function signBody(rawBody, signingKey) {
  const digest = crypto
    .createHmac("sha256", signingKey)
    .update(rawBody)
    .digest("hex");

  return `sha256=${digest}`;
}

const body = JSON.stringify({
  referenceId: "user-123",
  message: { type: "TEXT", text: "Hola" },
});

const signature = signBody(body, process.env.SIGNING_KEY);
// Header: X-Jelou-Signature: sha256=...

const crypto = require("crypto");

function verifySignature(rawBody, signatureHeader, signingKey) {
  const expected = `sha256=${crypto
    .createHmac("sha256", signingKey)
    .update(rawBody)
    .digest("hex")}`;

  if (!signatureHeader) {
    return false;
  }

  const provided = Buffer.from(signatureHeader, "utf8");
  const expectedBuf = Buffer.from(expected, "utf8");

  if (provided.length !== expectedBuf.length) {
    return false;
  }

  return crypto.timingSafeEqual(provided, expectedBuf);
}