freks blog

import crypto from 'crypto';

// Shopify Partner Dashboard > App > Client secret から取得
const SHARED_SECRET = "abcd"; // TODO: 環境変数などに保存してコードに書かないようにする

function isValidDigitalSignature(url: URL) {
  const queryParams = Object.fromEntries(url.searchParams);

  const signature = queryParams.signature;
  delete queryParams.signature;

  const sortedParams = Object.keys(queryParams)
    .sort()
    .map((key) => `${key}=${queryParams[key]}`)
    .join("");

  const calculatedSignature = crypto
    .createHmac("sha256", SHARED_SECRET)
    .update(sortedParams)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(signature, "hex"),
    Buffer.from(calculatedSignature, "hex"),
  );
}