Embedded Settings

timestamp=${timestamp}&shop_id=${id}&app_id=${app_id}

async function getHmacKey(secret) {
  const encoder = new TextEncoder();
  const keyData = encoder.encode(secret);
  return await crypto.subtle.importKey(
    'raw',
    keyData,
    { name: 'HMAC', hash: 'SHA-512' },
    false,
    ['sign', 'verify']
  );
}

async function verifySignature(params, hmacSignature, secret) {
  const { shopId, appId, timestamp } = params;

  const encoder = new TextEncoder();
  const key = await getHmacKey(secret);

  const data = `timestamp=${timestamp}&shop_id=${shopId}&app_id=${appId}`;

  const messageData = encoder.encode(data);
  const signature = await crypto.subtle.sign('HMAC', key, messageData);

  const providedSignature = base64ToUint8Array(hmacSignature);

  if (signature.byteLength !== providedSignature.length) {
    return false;
  }

  return crypto.subtle.verify('HMAC', key, providedSignature, messageData);
}