Integre o Uai ID em uma tarde

{
  "verification_id": "23923d24-9c1f-4b7e-a2d3-8f6b41c2e77a",
  "status": "approved",
  "score": 830,
  "reason_code": null,
  "face_similarity": 0.9562,
  "extracted": {
    "full_name": "MARIA DA SILVA",
    "birth_date": "1990-01-01",
    "doc_type": "cnh",
    "document_number": "01234567890"
  },
  "checks": {
    "document": "valid",
    "liveness": "passed",
    "face_match": "passed"
  },
  "identity_id": "id_8829f0a21",
  "completed_at": "2026-09-09T01:02:03Z"
}

// Node.js — SEMPRE confira a assinatura antes de confiar no corpo
import crypto from "crypto";

function verifyWebhookSignature(rawBody, signatureHeader, secret) {
  // Header: "t=1694123456,v1=5d41402abc4b2a76b9719d911017c592..."
  const parts = Object.fromEntries(
    signatureHeader.split(",").map((p) => p.split("="))
  );
  const t = parseInt(parts.t, 10);
  const sig = parts.v1;

  // Tolerância de 5 minutos contra replay attacks
  if (Math.abs(Date.now() / 1000 - t) > 300) {
    throw new Error("Assinatura expirada (possível replay attack)");
  }

  const expected = "v1=" + crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");

  if (expected !== `v1=${sig}`) {
    throw new Error("Assinatura inválida: payload adulterado");
  }

  return true;
}