Signing and verification

Patchwork-Signature: t=1756558800,v2=9ad30e71…

v2.{t}.{METHOD}.{path}?{query}.{base64(sha256(body))}

{t}.{METHOD}.{path}.{base64(sha256(body))}

import crypto from "crypto";

function verifyPatchwork(req, res, next) {
  const header = req.get("Patchwork-Signature");
  if (!header) return res.status(401).end();

  // A header carries one `t` and several values. Collect every `v2`: during a
  // rotation there is one per live secret, so keeping only the last would
  // compare the previous secret's value against your current one.
  const pairs = header.split(",").map((pair) => pair.split("="));
  const t = pairs.find(([k]) => k === "t")?.[1];
  const candidates = pairs.filter(([k]) => k === "v2").map(([, v]) => v);
  if (!t || candidates.length === 0) return res.status(401).end();

  // Reject replays.
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return res.status(401).end();

  // The query exactly as it arrived, and the raw body.
  const query = req.originalUrl.split("?")[1] ?? "";
  const target = query ? `${req.path}?${query}` : req.path;

  const digest = crypto.createHash("sha256").update(req.rawBody ?? "").digest("base64");
  const payload = `v2.${t}.${req.method}.${target}.${digest}`;

  // Try every secret you hold, against every value in the header.
  const ok = [CURRENT_SECRET, PREVIOUS_SECRET].filter(Boolean).some((secret) => {
    const expected = crypto.createHmac("sha256", secret).update(payload).digest("hex");
    return candidates.some(
      (value) =>
        // timingSafeEqual throws when the lengths differ, which would be a 500.
        value.length === expected.length &&
        crypto.timingSafeEqual(Buffer.from(value), Buffer.from(expected)),
    );
  });

  if (!ok) return res.status(401).end();
  next();
}

const claims = jwt.verify(bearer(req), PUBLIC_KEY, {
  algorithms: ["RS256"],
  audience: "your-api",
});
req.user = { id: claims.sub };

app.post("/patchwork/up", verifyPatchwork, (req, res) => {
  const proof = crypto
    .createHmac("sha256", REQUEST_SECRET)
    .update(`patchwork-up.v1:${req.body.nonce}`)
    .digest("hex");
  res.json({ nonce: req.body.nonce, proof });
});