NotMyWing · October 6, 2025 09:11
diff --git a/api.md b/api.md
diff --git a/http.ts b/http.ts
 import express from "express";
 import { createHash, createPublicKey, verify } from "crypto";

 // Get this from %t cert.
 const PUB_KEY_B64 = "MCowBQYDK2VwAyEAgZjOElmDPWLm5ldk3PPB5pQHeU80rx4Bzz/Bz0c5XSA=";

 const HEADERS = {
  signature: "x-leveret-signature-ed25519",
  timestamp: "x-leveret-timestamp",
  requestId: "x-leveret-request-id",
 };

 const PUBLIC_KEY = createPublicKey({
  key: Buffer.from(PUB_KEY_B64, "base64"),
  format: "der",
  type: "spki",
 });

 function verifyLeveretRequest(req: any): boolean {
  const h = req.headers ?? {};
  const sigB64 = h[HEADERS.signature];
  const ts = h[HEADERS.timestamp];
  const reqId = h[HEADERS.requestId];
  if (!sigB64 || !ts || !reqId) return false;

  const method = String(req.method ?? "GET").toUpperCase();
  const host = req.get?.("host") ?? h.host;
  if (!host) return false;

  const url = `${req.protocol ?? "https"}://${host}${req.originalUrl ?? req.url ?? ""}`;
  const bodyHash = createHash("sha256").update(req.rawBody ?? Buffer.alloc(0)).digest("hex");
  const canonical = [ts, reqId, method, url, bodyHash].join("\n");

  const signature = Buffer.from(sigB64, "base64");
  const valid = verify(null, Buffer.from(canonical), PUBLIC_KEY, signature);
  if (!valid) return false;

  const age = Math.abs(Date.now() - Date.parse(String(ts)));
  return Number.isFinite(age) && age <= 5 * 60_000;
 }

 const app = express();

 app.use(express.json({
  verify: (req, _res, buf) => ((req as any).rawBody = Buffer.from(buf)),
 }));

 app.get("/", (req, res) => {
  if (!verifyLeveretRequest(req)) {
    console.log(`Failed verification from ${req.ip}`);
    return res.status(401).send("invalid signature");
  }
  console.log(`Verified request from ${req.ip}`);
  res.send("verified");
 });

 app.listen(8080, () => console.log("Listening on :8080"));
	import express from "express";
	import { createHash, createPublicKey, verify } from "crypto";

	// Get this from %t cert.
	const PUB_KEY_B64 = "MCowBQYDK2VwAyEAgZjOElmDPWLm5ldk3PPB5pQHeU80rx4Bzz/Bz0c5XSA=";

	const HEADERS = {
	signature: "x-leveret-signature-ed25519",
	timestamp: "x-leveret-timestamp",
	requestId: "x-leveret-request-id",
	};

	const PUBLIC_KEY = createPublicKey({
	key: Buffer.from(PUB_KEY_B64, "base64"),
	format: "der",
	type: "spki",
	});

	function verifyLeveretRequest(req: any): boolean {
	const h = req.headers ?? {};
	const sigB64 = h[HEADERS.signature];
	const ts = h[HEADERS.timestamp];
	const reqId = h[HEADERS.requestId];
	if (!sigB64 \|\| !ts \|\| !reqId) return false;

	const method = String(req.method ?? "GET").toUpperCase();
	const host = req.get?.("host") ?? h.host;
	if (!host) return false;

	const url = `${req.protocol ?? "https"}://${host}${req.originalUrl ?? req.url ?? ""}`;
	const bodyHash = createHash("sha256").update(req.rawBody ?? Buffer.alloc(0)).digest("hex");
	const canonical = [ts, reqId, method, url, bodyHash].join("\n");

	const signature = Buffer.from(sigB64, "base64");
	const valid = verify(null, Buffer.from(canonical), PUBLIC_KEY, signature);
	if (!valid) return false;

	const age = Math.abs(Date.now() - Date.parse(String(ts)));
	return Number.isFinite(age) && age <= 5 * 60_000;
	}

	const app = express();

	app.use(express.json({
	verify: (req, _res, buf) => ((req as any).rawBody = Buffer.from(buf)),
	}));

	app.get("/", (req, res) => {
	if (!verifyLeveretRequest(req)) {
	console.log(`Failed verification from ${req.ip}`);
	return res.status(401).send("invalid signature");
	}
	console.log(`Verified request from ${req.ip}`);
	res.send("verified");
	});

	app.listen(8080, () => console.log("Listening on :8080"));
No results found