バックエンドが信頼できる USDT 支払い Webhook

import crypto from 'node:crypto'
import express from 'express'

const app = express()

app.post('/webhooks/boltutil', express.raw({ type: 'application/json' }), async (req, res) => {
  const timestamp = req.get('X-Bolt-Webhook-Timestamp') || ''
  const received = req.get('X-Bolt-Webhook-Signature') || ''
  const rawBody = req.body.toString('utf8')
  const expected = crypto
    .createHmac('sha256', process.env.BOLTUTIL_WEBHOOK_SECRET)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex')

  const recent = Number.isFinite(Number(timestamp)) && Math.abs(Date.now() - Number(timestamp)) < 300_000
  const wellFormed = /^[0-9a-f]{64}$/i.test(received)
  const valid = recent && wellFormed && crypto.timingSafeEqual(
    Buffer.from(received, 'hex'),
    Buffer.from(expected, 'hex')
  )
  if (!valid) return res.sendStatus(401)

  const event = JSON.parse(rawBody)
  await fulfillOnce(event.externalOrderId, event.txHash)
  return res.sendStatus(204)
})