import { createHmac, timingSafeEqual } from 'crypto';
function verifyOne(rawBody, signature, timestamp, secret) {
    if (!signature.startsWith('v0='))
        return false;
    const expected = `v0=${createHmac('sha256', secret).update(`v0:${timestamp}:${rawBody}`).digest('hex')}`;
    const a = Buffer.from(signature, 'utf8');
    const b = Buffer.from(expected, 'utf8');
    if (a.length !== b.length)
        return false;
    return timingSafeEqual(a, b);
}
export function verifySlackSignature(opts) {
    const { rawBody, timestamp, signature, signingSecret, previousSecret } = opts;
    const now = opts.now ?? Math.floor(Date.now() / 1000);
    const skew = opts.skewSeconds ?? 5 * 60;
    const ts = Number(timestamp);
    if (!Number.isFinite(ts))
        return false;
    if (Math.abs(now - ts) > skew)
        return false;
    if (verifyOne(rawBody, signature, timestamp, signingSecret))
        return true;
    if (previousSecret && verifyOne(rawBody, signature, timestamp, previousSecret))
        return true;
    return false;
}
//# sourceMappingURL=signature.js.map