From ada60c957652552b0854a8fa56a369ae624678b4 Mon Sep 17 00:00:00 2001
From: aiirvizionz <david.lopezhuerta01@gmail.com>
Date: Fri, 10 Jul 2026 07:53:43 -0600
Subject: [PATCH] Accept listed webhook signatures

---
 lib/webhooks.ts | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/lib/webhooks.ts b/lib/webhooks.ts
index c73f539..ef3bec1 100644
--- a/lib/webhooks.ts
+++ b/lib/webhooks.ts
@@ -19,8 +19,14 @@ export function verifyWebhook(headers: Record<string, string | null | undefined>
   const tsNum = parseInt(String(ts), 10);
   if (!Number.isFinite(tsNum) || Math.abs(Math.floor(Date.now() / 1000) - tsNum) > TOLERANCE) return false;
   const expected = `v1,${crypto.createHmac("sha256", secret).update(`${id}.${ts}.${body}`).digest("base64")}`;
-  const a = Buffer.from(String(sig)), b = Buffer.from(expected);
-  return a.length === b.length && crypto.timingSafeEqual(a, b);
+  const expectedBytes = Buffer.from(expected);
+  return String(sig)
+    .split(/\s+/)
+    .filter(Boolean)
+    .some((candidate) => {
+      const candidateBytes = Buffer.from(candidate.trim());
+      return candidateBytes.length === expectedBytes.length && crypto.timingSafeEqual(candidateBytes, expectedBytes);
+    });
 }
 
 export function newSecret(prefix = "whsec_") {