${timestamp}.${raw_json_body}

POST /api/webhooks/maildesk

import crypto from 'crypto'
import express from 'express'

const app = express()

// Keep raw bytes for exact signature verification
app.use('/api/webhooks/maildesk', express.raw({ type: 'application/json' }))

function verifyMaildeskSignature(rawBody: Buffer, timestamp: string, signatureHeader: string, secret: string) {
  const parts = Object.fromEntries(
    signatureHeader.split(',').map(kv => {
      const [k, v] = kv.split('=')
      return [k?.trim(), v?.trim()]
    }),
  )

  const v1 = parts.v1
  const t = parts.t
  if (!v1 || !t || t !== timestamp) return false

  const payload = `${timestamp}.${rawBody.toString('utf8')}`
  const expected = crypto.createHmac('sha256', secret).update(payload).digest('hex')

  try {
    return crypto.timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(v1, 'hex'))
  } catch {
    return false
  }
}

app.post('/api/webhooks/maildesk', (req, res) => {
  const timestamp = req.header('X-Maildesk-Timestamp')
  const sig = req.header('X-Maildesk-Signature')

  if (!timestamp || !sig) {
    return res.status(401).send('Missing Maildesk signature headers')
  }

  const maxSkewSeconds = 5 * 60
  const now = Math.floor(Date.now() / 1000)
  if (Math.abs(now - Number(timestamp)) > maxSkewSeconds) {
    return res.status(401).send('Stale timestamp')
  }

  const ok = verifyMaildeskSignature(req.body as Buffer, timestamp, sig, process.env.MAILDESK_WEBHOOK_SECRET!)
  if (!ok) {
    return res.status(401).send('Invalid signature')
  }

  const event = JSON.parse((req.body as Buffer).toString('utf8'))

  // TODO: idempotency + async processing
  // queue.publish(event)

  return res.status(200).send('ok')
})

{
  "type": "subscriber.confirmed",
  "eventId": "01HV...",
  "id": "contact-id",
  "firstName": "Jane",
  "lastName": "Doe",
  "email": "jane@example.com",
  "status": "subscribed",
  "createdAt": "2026-04-21T07:30:00.000Z"
}