{
  "type": "usage.event.created",
  "data": {
    "event_id": "0f7c…",
    "occurred_at": "2026-08-12T09:14:22.104Z",
    "org_id": "9b2e…",
    "api_key_id": "3ad1…",
    "public_model_id": "openai/gpt-5.5",
    "channel": "chat",
    "billed_units": { "input_tokens": 812, "output_tokens": 241 },
    "cost_credits_minor": 143,
    "upstream_cost_micro_usd": 21400,
    "request_id": "req_…",
    "cache_hit": false,
    "status": "ok"
  }
}

webhook-id:        <ไม่ซ้ำต่อหนึ่ง delivery>
webhook-timestamp: <unix seconds>
webhook-signature: v1,<base64 hmac-sha256>
x-prism-event-type: usage.event.created

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyPrismWebhook(headers, rawBody, secret) {
  const id = headers["webhook-id"];
  const ts = headers["webhook-timestamp"];
  const sigHeader = headers["webhook-signature"] ?? "";

  // ตรวจเวลาก่อน — ลายเซ็นถูกต้องบน body เก่าหกเดือนก็ยังเป็น replay
  if (!ts || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;

  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = createHmac("sha256", key)
    .update(`${id}.${ts}.${rawBody}`)
    .digest("base64");

  // header อาจมีหลายลายเซ็นคั่นด้วยช่องว่างระหว่างช่วงหมุน secret
  return sigHeader.split(" ").some((part) => {
    if (!part.startsWith("v1,")) return false;
    const got = Buffer.from(part.slice(3), "utf8");
    const want = Buffer.from(expected, "utf8");
    return got.length === want.length && timingSafeEqual(got, want);
  });
}