#!/usr/bin/env sh
set -eu

# Save the exact, unparsed request bytes as payload.json and export the received
# X-DesignGen-Signature header and one-time webhook secret before running.
test -n "${DESIGNGEN_SIGNATURE:-}"
test -n "${DESIGNGEN_WEBHOOK_SECRET:-}"
test -f payload.json

timestamp="$(printf '%s' "$DESIGNGEN_SIGNATURE" | sed -E 's/^t=([0-9]+),.*/\1/')"
received="$(printf '%s' "$DESIGNGEN_SIGNATURE" | sed -E 's/.*v1=([0-9a-f]+)$/\1/')"
expected="$(
  { printf '%s.' "$timestamp"; cat payload.json; } |
    openssl dgst -sha256 -hmac "$DESIGNGEN_WEBHOOK_SECRET" -hex |
    sed 's/^.*= //'
)"

test "$received" = "$expected"
printf '%s\n' 'DesignGen signature verified'