Improve printful secret hash

packages/commerce/src/printful.ts

@@ -1,6 +1,7 @@
 import type { Printful } from "./util/types";
 import { type DeepPartial, type PagingOptions } from "./util/misc";
 import { RateLimitError, parseRetryAfterMs } from "@blade-and-brawn/domain";
+import { timingSafeEqual } from "crypto";
 
 const parsePayload = (res: Response): Promise<unknown> =>
     res.json().catch(() => res.text().catch(() => undefined));
@@ -8,6 +9,7 @@ const parsePayload = (res: Response): Promise<unknown> =>
 type ClientOptions = {
     token: string;
     storeId: string;
+    webhookSecret: string;
 };
 
 type Credentials = {
@@ -186,10 +188,24 @@ class WebhooksClient {
     }
 }
 
+class UtilClient {
+    constructor(private printfulSecret: string) { }
+
+    verifySecret(secret: string): boolean {
+        try {
+            return timingSafeEqual(Buffer.from(secret, "hex"), Buffer.from(this.printfulSecret, "hex"));
+        }
+        catch {
+            return false;
+        }
+    }
+}
+
 export class PrintfulClient {
     readonly Products: ProductsClient;
     readonly Orders: OrdersClient;
     readonly Webhooks: WebhooksClient;
+    readonly Util: UtilClient;
 
     constructor(options: ClientOptions) {
         const creds: Credentials = {
@@ -202,6 +218,7 @@ export class PrintfulClient {
         this.Products = new ProductsClient(creds);
         this.Orders = new OrdersClient(creds);
         this.Webhooks = new WebhooksClient(creds);
+        this.Util = new UtilClient(options.webhookSecret);
     }
 
     static Util = {

packages/commerce/src/webflow.ts

@@ -340,7 +340,7 @@ class CollectionsClient {
 class UtilClient {
     constructor(private webhookSecret: string) { }
 
-    verifyWebflowSignature(request: Request, body: unknown): boolean {
+    verifySecret(request: Request, body: unknown): boolean {
         const timestamp = request.headers.get("x-webflow-timestamp");
         if (!timestamp) return false;