A deliberately narrow API.

#!/usr/bin/env bash
set -euo pipefail

: "${VIALAPI_TEST_KEY:?Set VIALAPI_TEST_KEY to an expiring vial_test_ credential}"
VIALAPI_BASE_URL="${VIALAPI_BASE_URL:-https://vialapi.com}"

curl --fail-with-body --silent --show-error \
  --request GET "${VIALAPI_BASE_URL}/api/v1/catalog?limit=20" \
  --header "Authorization: Bearer ${VIALAPI_TEST_KEY}" \
  --header "Accept: application/json"

# Replace VIAL-EXAMPLE-SKU with vialApiSku from the authenticated catalog.
curl --fail-with-body --silent --show-error \
  --request POST "${VIALAPI_BASE_URL}/api/v1/orders/validate" \
  --header "Authorization: Bearer ${VIALAPI_TEST_KEY}" \
  --header "Accept: application/json" \
  --header "Content-Type: application/json" \
  --data '{"lineItems":[{"sku":"VIAL-EXAMPLE-SKU","quantity":1}]}'

# Use the exact same Idempotency-Key and exact JSON bytes after an uncertain result.
curl --fail-with-body --silent --show-error \
  --request POST "${VIALAPI_BASE_URL}/api/v1/orders" \
  --header "Authorization: Bearer ${VIALAPI_TEST_KEY}" \
  --header "Accept: application/json" \
  --header "Content-Type: application/json" \
  --header "Idempotency-Key: quickstart-order-001" \
  --data '{"externalOrderId":"QUICKSTART-001","customer":{"firstName":"API","lastName":"Certification","email":"api-certification@example.test"},"shipTo":{"recipientName":"API Certification","address1":"100 Example Avenue","city":"Atlanta","state":"GA","postalCode":"30309","country":"US","residential":true},"lineItems":[{"sku":"VIAL-EXAMPLE-SKU","quantity":1}],"metadata":{"source":"published-quickstart","vialapiSandboxScenario":"standard"}}'

import { createHmac, timingSafeEqual } from "node:crypto";

type WebhookHeaders = {
  "webhook-id": string;
  "webhook-timestamp": string;
  "webhook-signature": string;
};

/** Verify the exact raw bytes before parsing JSON, then deduplicate webhook-id. */
export function verifyVialApiWebhook({
  headers,
  rawBody,
  secret,
  nowSeconds = Math.floor(Date.now() / 1_000),
  toleranceSeconds = 5 * 60
}: {
  headers: WebhookHeaders;
  rawBody: string;
  secret: string;
  nowSeconds?: number;
  toleranceSeconds?: number;
}) {
  if (!/^\d+$/u.test(headers["webhook-timestamp"])) return false;
  const sentAt = Number(headers["webhook-timestamp"]);
  if (!Number.isSafeInteger(sentAt) || Math.abs(nowSeconds - sentAt) > toleranceSeconds) return false;
  if (!secret.startsWith("whsec_")) return false;

  const encodedSecret = secret.slice("whsec_".length);
  const key = Buffer.from(encodedSecret, "base64");
  if (key.length < 24 || key.length > 64 || key.toString("base64") !== encodedSecret) return false;
  const expected = createHmac("sha256", key)
    .update(`${headers["webhook-id"]}.${headers["webhook-timestamp"]}.${rawBody}`, "utf8")
    .digest();

  return headers["webhook-signature"].split(/\s+/u).some((candidate) => {
    const match = /^v1,([A-Za-z0-9+/]+={0,2})$/u.exec(candidate);
    if (!match?.[1]) return false;
    const received = Buffer.from(match[1], "base64");
    return received.length === expected.length && timingSafeEqual(received, expected);
  });
}