Verify identity before signing

// verify.js
const headers = {
  Authorization: `Bearer ${process.env.SAJN_API_KEY}`,
  "Sajn-Version": "2026-10",
  "Content-Type": "application/json",
};

export const startCheck = async (application) => {
  const response = await fetch("https://app.sajn.se/api/v1/identity-checks", {
    method: "POST",
    headers,
    body: JSON.stringify({
      fullName: application.name,
      nationalId: application.nationalId,
      channel: "EMAIL",
      email: application.email,
      reference: application.id,
      language: "en",
    }),
  });
  const check = await response.json();
  if (!response.ok) throw new Error(`${check.code}: ${check.message} (${check.requestId})`);
  return check.id;
};

// server.js
import crypto from "node:crypto";

import express from "express";

import { findApplication } from "./applications.js"; // Your own lookup.

const headers = {
  Authorization: `Bearer ${process.env.SAJN_API_KEY}`,
  "Sajn-Version": "2026-10",
  "Content-Type": "application/json",
};

const sajn = async (method, path, body, idempotencyKey) => {
  const response = await fetch(`https://app.sajn.se/api/v1${path}`, {
    method,
    headers: idempotencyKey ? { ...headers, "Idempotency-Key": idempotencyKey } : headers,
    body: JSON.stringify(body),
  });
  const data = await response.json();
  if (!response.ok) throw new Error(`${data.code}: ${data.message} (${data.requestId})`);
  return data;
};

const isSignedBySajn = (headers, rawBody) => {
  const id = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  if (!id || Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  const key = Buffer.from(process.env.SAJN_WEBHOOK_SECRET.replace(/^whsec_/, ""), "base64");
  const expected = crypto.createHmac("sha256", key).update(`${id}.${timestamp}.${rawBody}`).digest();
  return String(headers["webhook-signature"] ?? "")
    .split(" ")
    .some((entry) => {
      const [version, signature = ""] = entry.split(",");
      const received = Buffer.from(signature, "base64");
      return version === "v1" && received.length === expected.length && crypto.timingSafeEqual(received, expected);
    });
};

const app = express();

app.post("/webhooks/sajn", express.raw({ type: "application/json" }), async (req, res) => {
  if (!isSignedBySajn(req.headers, req.body)) return res.status(401).end();
  res.status(200).end();

  const { type, data } = JSON.parse(req.body);
  if (!type.startsWith("identity_check.")) return;

  const check = data.object;
  const application = await findApplication(check.reference);

  if (type !== "identity_check.verified") {
    console.log(`Application ${application.id}: identity check ${check.status}`);
    return;
  }

  const document = await sajn("POST", "/documents", {
    name: `Credit agreement - ${application.name}`,
    templateId: process.env.SAJN_TEMPLATE_ID,
    externalId: application.id,
    parties: [{
      name: application.name,
      email: application.email,
      role: "SIGNER",
      requiredSignature: "SE_BANKID",
    }],
  }, `contract-${application.id}-create`);

  await sajn("PATCH", `/documents/${document.id}/parties/${document.parties[0].id}`, {
    nationalId: application.nationalId,
  });

  await sajn("POST", `/documents/${document.id}/send`, {}, `contract-${application.id}-send`);
  console.log(`Application ${application.id}: contract ${document.id} sent`);
});

app.listen(3000);