import { getLogger } from '@nangohq/utils';
import crypto from 'crypto';
const logger = getLogger('Webook.GithubApp');
function validate(integration, headerSignature, body) {
    const hash = `${integration.oauth_client_id}${integration.oauth_client_secret}${integration.app_link}`;
    const secret = crypto.createHash('sha256').update(hash).digest('hex');
    const signature = crypto.createHmac('sha256', secret).update(JSON.stringify(body)).digest('hex');
    const trusted = Buffer.from(`sha256=${signature}`, 'ascii');
    const untrusted = Buffer.from(headerSignature, 'ascii');
    return crypto.timingSafeEqual(trusted, untrusted);
}
export default async function route(nango, integration, headers, body, logContextGetter) {
    const signature = headers['x-hub-signature-256'];
    if (signature) {
        logger.info('Signature found, verifying...');
        const valid = validate(integration, signature, body);
        if (!valid) {
            logger.error('Github App webhook signature invalid');
            return;
        }
    }
    return nango.executeScriptForWebhooks(integration, body, 'installation.id', 'installation_id', logContextGetter);
}
//# sourceMappingURL=github-app-webhook-routing.js.map