Restaurant data with narrow permissions and durable delivery.

Node.js verification example

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyOrderDock(rawBody, signature, secret) {
  const parts = Object.fromEntries(
    signature.split(",").map((part) => part.split("=", 2))
  );
  const timestamp = parts.t;
  const supplied = parts.v1;
  if (!timestamp || !supplied || Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return false;
  }
  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");
  return supplied.length === expected.length &&
    timingSafeEqual(Buffer.from(supplied), Buffer.from(expected));
}