Webhooks de CallSpace

{
  "id": "8f14e45f-ceea-467a-9f6e-4f2c1e0b3a77",
  "eventId": "b1c2d3e4-5f60-4a7b-8c9d-0e1f2a3b4c5d",
  "event": "call.completed",
  "version": 1,
  "createdAt": "2026-08-24T10:00:00.000Z",
  "workspaceId": "2c8a1f6e-7b90-4d3a-8e5f-1a2b3c4d5e6f",
  "data": {
    "callId": "a3d9c1b2-4e5f-4a6b-9c8d-7e6f5a4b3c2d",
    "callSid": "CA1234567890abcdef1234567890abcd",
    "direction": "inbound",
    "status": "completed",
    "from": "+34600000000",
    "to": "+34911223344",
    "durationSeconds": 128
  }
}

import crypto from 'node:crypto';

// El HMAC cubre "<timestamp>.<cuerpo crudo>". Necesitas el BODY SIN PARSEAR:
// si tu framework ya lo convirtió a objeto, vuelve a serializarlo y la firma
// dejará de cuadrar.
export function verifyCallspaceWebhook(rawBody, headers, secret) {
    const header = headers['x-callspace-signature'] ?? '';
    const parts = Object.fromEntries(
        header.split(',').map((part) => part.trim().split('=')),
    );

    const timestamp = Number.parseInt(parts.t, 10);
    if (!Number.isFinite(timestamp)) return false;

    // Rechaza reenvíos antiguos.
    const age = Math.abs(Math.floor(Date.now() / 1000) - timestamp);
    if (age > 300) return false;

    const expected = crypto
        .createHmac('sha256', secret)
        .update(`${timestamp}.${rawBody}`)
        .digest('hex');

    // Comparación en tiempo constante: un === filtraría el secreto por timing.
    const a = Buffer.from(expected, 'utf8');
    const b = Buffer.from(parts.v1 ?? '', 'utf8');
    return a.length === b.length && crypto.timingSafeEqual(a, b);
}