Stripe webhook signature verification

const { WebApp } = require(class="tk-str">'@hyperbridge/forge/server');
const crypto    = require(class="tk-str">'crypto');
const app       = new WebApp();

app.post(class="tk-str">'/webhook/stripe', async (c) => {
  const sig   = c.req.header(class="tk-str">'stripe-signature');
  const raw   = await c.req.text();
  const parts = Object.fromEntries(
    sig.split(class="tk-str">',').map(p => p.split(class="tk-str">'='))
  );
  const expected = crypto.createHmac(class="tk-str">'sha256', process.env.STRIPE_SECRET)
    .update(class="tk-str">`${parts.t}.${raw}`)
    .digest(class="tk-str">'hex');

  if (parts.v1 !== expected) return c.text(class="tk-str">'bad signature', 400);

  const event = JSON.parse(raw);
  console.log(class="tk-str">'stripe event:', event.type);
  return c.json({ received: true });
});

app.listen(3000);