Envie os dados para onde você trabalha

import { createHmac, timingSafeEqual } from "node:crypto";

const MAX_AGE_SECONDS = 300; // Retries are re-signed with a fresh timestamp.

export async function POST(request: Request) {
  const body = Buffer.from(await request.arrayBuffer());
  const timestamp = request.headers.get("x-polymorfa-timestamp") ?? "";
  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!/^\d+$/.test(timestamp) || age > MAX_AGE_SECONDS) {
    return new Response(null, { status: 401 });
  }
  const expected = "sha256=" + createHmac("sha256", drainSecret)
    .update(timestamp + "." + body)
    .digest("hex");
  const given = request.headers.get("x-polymorfa-signature") ?? "";
  if (given.length !== expected.length ||
      !timingSafeEqual(Buffer.from(given), Buffer.from(expected))) {
    return new Response(null, { status: 401 });
  }

  // Take the delivery ID from the signed body, not a header. NDJSON
  // carries it on every line; retries keep it, so store once.
  const ndjson = request.headers.get("content-type")?.startsWith("application/x-ndjson");
  const envelope = JSON.parse(ndjson ? body.toString().split("\n")[0] : body.toString());
  await warehouse.insertOnce(envelope.deliveryId, body);
  return new Response(null, { status: 204 });
}