Init Data

import { retrieveInitData } from '@exode-team/sdk/miniapp'

const initData = retrieveInitData()
// a string like "page_id=…&school_id=…&auth_date=…&user=…&session_uuid=…&hash=…"
// null if the page was not opened from Exode (no exodeInitData in the fragment)

await fetch('/api/session', {
  method: 'POST',
  headers: { 'X-Exode-Init-Data': initData ?? '' },
})

import { verifyInitData } from '@exode-team/sdk/miniapp/server'

// initData is the string sent by the browser (in the example above, the X-Exode-Init-Data header)
const payload = verifyInitData(initData, {
  secret: process.env.EXODE_PAGE_SECRET!,
  maxAgeSec: 86_400, // auth_date validity window, 24 hours by default
})

payload.pageId    // page id
payload.schoolId  // school id
payload.authDate  // issue time, unix seconds
payload.user      // { id, firstName, lastName, avatar, language } | null for a guest; avatar is a URL or null

data_check_string = key-sorted "key=value" pairs of all fields
                    except hash, joined with "\n" (URL-decoded values)
secret_key = HMAC_SHA256(key = "ExodeMiniApp", message = page_secret)
hash       = hex( HMAC_SHA256(key = secret_key, message = data_check_string) )

const crypto = require('crypto')

function verify(initData, secret, maxAgeSec = 86400) {
  const params = new URLSearchParams(initData)
  const hash = params.get('hash') ?? ''

  params.delete('hash')

  const dcs = [...params.keys()].sort()
    .map((k) => `${k}=${params.get(k)}`)
    .join('\n')

  const secretKey = crypto.createHmac('sha256', 'ExodeMiniApp').update(secret).digest()
  const check = crypto.createHmac('sha256', secretKey).update(dcs).digest('hex')

  const valid = hash.length === check.length
    && crypto.timingSafeEqual(Buffer.from(hash), Buffer.from(check))

  const age = Math.floor(Date.now() / 1000) - Number(params.get('auth_date'))

  return valid && age <= maxAgeSec
}