const signingSecret = process.env.SLACK_SECRET;
  const requestSignature = req.headers['x-slack-signature'];
  const requestTimestamp = req.headers['x-slack-request-timestamp'];
  const requestBody = req.rawBody;

  if (!signingSecret) {
    const err = new Error('Slack signing secret not found.');
    err.code = 500;
    throw err;
  }

  if (!requestSignature || !requestTimestamp) {
    const err = new Error('Missing Slack validation headers.');
    err.code = 400;
    throw err;
  }

  // Prevent replay attacks by verifying the timestamp is recent
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - Number(requestTimestamp)) > 60 * 5) {
    const err = new Error('Slack request timestamp is too old.');
    err.code = 401;
    throw err;
  }

  const hmac = crypto.createHmac('sha256', signingSecret);
  hmac.update('v0:' + requestTimestamp + ':', 'utf8');
  hmac.update(requestBody || '');
  const expectedSignature = 'v0=' + hmac.digest('hex');

  const sigBuffer = Buffer.from(requestSignature, 'utf8');
  const expBuffer = Buffer.from(expectedSignature, 'utf8');

  if (
    sigBuffer.length !== expBuffer.length ||
    !crypto.timingSafeEqual(sigBuffer, expBuffer)
  ) {
    const err = new Error('Invalid Slack signature.');
    err.code = 401;
    throw err;
  }