EDI Configuration

# Core
EDI_BIND_ADDR=0.0.0.0:8480
EDI_API_TOKEN=edi_prod_9f2c…
EDI_DATA_DIR=/var/lib/stateset-edi
EDI_RATE_LIMIT_RPM=600
# One trusted proxy in front, so client IPs are read from X-Forwarded-For
EDI_TRUSTED_PROXY_HOPS=1
# Shared coordination state; without this each instance keeps its own files
DATABASE_URL=postgres://edi:edi@db.internal:5432/stateset_edi

# StateSet integration
STATESET_API_KEY=sk_live_…
STATESET_SEQUENCER_URL=https://api.sequencer.stateset.com/v1
STATESET_EDI_WEBHOOK_SECRET=whsec_…
EDI_FLUSH_SECONDS=30

import { createHmac, timingSafeEqual } from 'node:crypto';

function verifyEdiDelivery(rawBody, headers, secret) {
  const ts     = headers['x-stateset-edi-timestamp'];
  const header = headers['x-stateset-edi-signature'] ?? '';
  if (!ts || !header.startsWith('sha256=')) return false;

  const signed   = Buffer.concat([Buffer.from(`${ts}.`), rawBody]);
  const expected = createHmac('sha256', secret).update(signed).digest();
  const provided = Buffer.from(header.slice(7), 'hex');

  return provided.length === expected.length && timingSafeEqual(provided, expected);
}