SecClaw 文档中心：快速开始、API 概览与集成指南

// 校验来自 SecClaw 的 Webhook 签名，防止伪造审批回执
function verifySecClawWebhook(req, secret) {
  const timestamp = req.headers['x-secclaw-timestamp'];
  const signature = req.headers['x-secclaw-signature'];

  // 1) 时间窗校验：拒绝过期请求，防止重放
  if (Math.abs(Date.now() - Number(timestamp)) > 300000) {
    return { ok: false, reason: 'timestamp_out_of_window' };
  }

  // 2) 使用原始请求体（不要用已解析后的对象）重算 HMAC
  const expected = hmacSha256(secret, timestamp + '.' + req.rawBody);

  // 3) 恒定时间比较，避免时序侧信道
  if (!timingSafeEqual(expected, signature)) {
    return { ok: false, reason: 'bad_signature' };
  }

  // 4) 幂等校验：同一 approval_id 只处理一次
  const payload = JSON.parse(req.rawBody);
  if (seenApprovalIds.has(payload.approval_id)) {
    return { ok: true, duplicate: true };
  }
  return { ok: true, payload };
}