Web APIの仕組みとモダン連携アーキテクチャ徹底解説

import express, { Request, Response, NextFunction } from 'express';
import Redis from 'ioredis';

const redis = new Redis();
const app = express();
app.use(express.json());

// Idempotency Middleware for Mutating POST Routes
async function idempotencyMiddleware(req: Request, res: Response, next: NextFunction) {
  if (req.method !== 'POST') return next();

  const key = req.headers['idempotency-key'] as string;
  if (!key) return next(); // In strict APIs, you can require this header

  const cacheKey = `idempotency:${key}`;
  const cachedResponse = await redis.get(cacheKey);

  if (cachedResponse) {
    const { status, body } = JSON.parse(cachedResponse);
    return res.status(status).set('X-Cache-Lookup', 'HIT').json(body);
  }

  // Intercept res.json to capture response
  const originalJson = res.json.bind(res);
  res.json = (body: any) => {
    if (res.statusCode >= 200 && res.statusCode < 300) {
      redis.set(cacheKey, JSON.stringify({ status: res.statusCode, body }), 'EX', 86400); // 24hr TTL
    }
    return originalJson(body);
  };

  next();
}

app.post('/v1/orders', idempotencyMiddleware, async (req, res) => {
  // Safe from duplicate execution upon network retry
  res.status(201).json({ id: 'ord_987', status: 'created', timestamp: Date.now() });
});

import crypto from 'crypto';

function verifyWebhookSignature(payloadRawBuffer, signatureHeader, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payloadRawBuffer)
    .digest('hex');

  // Use timingSafeEqual to prevent side-channel timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(signatureHeader),
    Buffer.from(expectedSignature)
  );
}