Generic HTTPS

✔ Created drain drn_9f31a7c04b2e615d8a03cc71 (pending_verification)

Signing secret (shown once — store it now):

  whsec_7Qb3xA1mR8pK0sVnT4uZ2yL6cE9dW5gH

Next: make your endpoint echo X-Lua-Verify, then run
  lua drains verify drn_9f31a7c04b2e615d8a03cc71

import express from 'express';
import { createHmac, timingSafeEqual } from 'node:crypto';
import { gunzipSync } from 'node:zlib';

const SECRETS = [process.env.LUA_DRAIN_SECRET, process.env.LUA_DRAIN_SECRET_PREVIOUS].filter(Boolean);
const TOLERANCE_SECONDS = 300;
// You must inflate before you can verify, so the gunzip runs on an
// unauthenticated body. Refuse above the first cap before inflating; the second
// bounds what inflating can produce. See /drains/verify-signatures.
const MAX_COMPRESSED_BYTES = 2 * 1024 * 1024;
const MAX_UNCOMPRESSED_BYTES = 8 * 1024 * 1024;
const seen = new Map(); // record id -> expiry. Use Redis with a TTL in production.

function verifySignature(header, rawBody) {
  if (!header) return false;
  let t = null;
  const candidates = [];
  for (const piece of header.split(',')) {
    const eq = piece.indexOf('=');
    if (eq < 0) return false;
    const key = piece.slice(0, eq).trim();
    const value = piece.slice(eq + 1).trim();
    if (key === 'v1') candidates.push(value);
    else if (key === 't') t = Number(value);
  }
  if (!Number.isFinite(t) || candidates.length === 0) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > TOLERANCE_SECONDS) return false;

  // The signed string is `${t}.${body}` over the UNCOMPRESSED body.
  const base = Buffer.concat([Buffer.from(`${t}.`, 'utf8'), rawBody]);
  let ok = false;
  for (const secret of SECRETS) {
    const expected = createHmac('sha256', secret).update(base).digest();
    for (const candidate of candidates) {
      const given = Buffer.from(candidate, 'hex');
      // Compare every candidate: no early return, so timing says nothing.
      if (given.length === expected.length && timingSafeEqual(given, expected)) ok = true;
    }
  }
  return ok;
}

const app = express();

// `limit` is the COMPRESSED cap: express answers 413 before we see the body.
// inflate:false keeps the compressed bytes so we can gunzip them ourselves and
// sign over exactly what the platform signed.
app.post('/lua', express.raw({ type: '*/*', limit: MAX_COMPRESSED_BYTES, inflate: false }), (req, res) => {
  let rawBody = req.body;
  if (req.get('content-encoding') === 'gzip') {
    try {
      // maxOutputLength makes zlib refuse to allocate past the cap rather than
      // returning the buffer, so a gzip bomb is never held in memory.
      rawBody = gunzipSync(req.body, { maxOutputLength: MAX_UNCOMPRESSED_BYTES });
    } catch (err) {
      const tooLarge = err?.code === 'ERR_BUFFER_TOO_LARGE';
      return res.status(tooLarge ? 413 : 400).json({ error: tooLarge ? 'too large' : 'bad gzip' });
    }
  }

  if (!verifySignature(req.get('X-Lua-Signature'), rawBody)) {
    return res.status(401).json({ error: 'bad signature' });
  }

  // Ownership verification: echo the token straight back.
  const verifyToken = req.get('X-Lua-Verify');
  if (verifyToken) res.set('X-Lua-Verify', verifyToken);

  const batch = JSON.parse(rawBody.toString('utf8'));
  const now = Date.now();
  for (const [id, expiry] of seen) if (expiry < now) seen.delete(id);

  for (const record of batch.records) {
    if (seen.has(record.id)) continue;          // at-least-once: this is the dedup key
    seen.set(record.id, now + 6 * 60 * 60 * 1000); // one retry horizon
    store(batch.resource, record);
  }

  res.status(204).end();                         // answer fast; do the work after
});

function store(resource, record) {
  console.log(
    resource['lua.agent.id'],
    record.eventName,
    record.severityText,
    record.body ?? '',
  );
}

app.listen(8080);

✔ 200 in 142 ms — "ok"
  batch 01JBWA6R1KD3P8N0SY4V2XQZ7T · 1 record · lua.drain.test