It’s disconcerting that layoffs are now seemingly a quarterly affair at Google despite a massive $23.6B in profits in Q1

Never interrupt your enemy when they are making a mistake!

async function auth(apiToken: string, telegramInitData: string) {
    const initData = new URLSearchParams(telegramInitData);

    // URLSearchParams.sort() might not be available in all environments
    // so a manual sort implementation could be necessary. For simplicity, we'll skip sorting here.

    const hash = initData.get("hash");
    initData.delete("hash");

    const dataToCheck = Array.from(initData).map(([key, value]) => `${key}=${value}`).join("\n");

    // Key preparation: First, derive the secretKey from 'WebAppData' and apiToken
    const encoder = new TextEncoder();
    const secretKeyMaterial = await crypto.subtle.importKey(
        "raw",
        encoder.encode("WebAppData"),
        { name: "HMAC", hash: { name: "SHA-256" } },
        false,
        ["sign"]
    );
    const secretKey = await crypto.subtle.sign(
        "HMAC",
        secretKeyMaterial,
        encoder.encode(apiToken)
    );

    // Use the derived secretKey to HMAC the dataToCheck
    const hmacKey = await crypto.subtle.importKey(
        "raw",
        secretKey,
        { name: "HMAC", hash: { name: "SHA-256" } },
        false,
        ["sign"]
    );

    const signatureBuffer = await crypto.subtle.sign(
        "HMAC",
        hmacKey,
        encoder.encode(dataToCheck)
    );

    const _hash = bufferToHex(signatureBuffer);

    console.log(hash, _hash)

    return hash === _hash;
}

function bufferToHex(buffer: ArrayBuffer): string {
    const byteArray = new Uint8Array(buffer);
    return byteArray.reduce((str, byte) => str + byte.toString(16).padStart(2, '0'), '');
}

"Our IQ might be Room Temperature"
- Primeagen