Device Intelligence for Node.js

import express from 'express'
import crypto from 'crypto'
const app = express()
app.use(express.json({ verify: (req, _res, buf) => ((req as any).rawBody = buf) }))
// Recompute the HMAC-SHA256 over "<t>.<rawBody>" and compare it.
function verify(rawBody: Buffer, header: string, secret: string): boolean {
  const p = Object.fromEntries(header.split(',').map((kv) => kv.split('=') as [string, string]))
  const signed = Buffer.concat([Buffer.from(`${p.t}.`), rawBody])
  const expected = crypto.createHmac('sha256', secret).update(signed).digest('hex')
  const a = Buffer.from(p.v1, 'hex')
  const b = Buffer.from(expected, 'hex')
  return a.length === b.length && crypto.timingSafeEqual(a, b)
}
app.post('/webhook/tracio', (req, res) => {
  const sig = req.headers['x-tracio-signature'] as string
  if (!verify((req as any).rawBody, sig, process.env.TRACIO_WEBHOOK_SECRET!)) {
    return res.status(401).json({ error: 'Invalid signature' })
  }
  const event = req.body
  if (event.bot.result === 'bot') {
    return res.status(200).json({ action: 'blocked', visitorId: event.visitorId })
  }
  if (event.decision.riskScore > 50) {
    return res.status(200).json({ action: 'review', visitorId: event.visitorId })
  }
  res.status(200).json({ action: 'allow', visitorId: event.visitorId })
})
app.listen(3000)