Share a private GitHub repo as a read-only link

import { createHmac, timingSafeEqual } from "node:crypto";

const WINDOW_MS = 5 * 60 * 1000;

export async function authorize(req: Request) {
  const sig = req.headers.get("x-acme-signature");
  const ts  = req.headers.get("x-acme-timestamp");
  if (!sig || !ts) throw new Unauthorized("missing signature");

  const age = Date.now() - Number(ts);
  if (age > WINDOW_MS) throw new Unauthorized("stale request");

  const body     = await req.text();
  const expected = createHmac("sha256", SECRET)
    .update(`${ts}.${body}`)
    .digest();

  if (!timingSafeEqual(Buffer.from(sig, "hex"), expected)) {
    throw new Unauthorized("bad signature");
  }

  return JSON.parse(body);
}