Implement verifyWebhookSignature(body, signature, secret, hmacSha256)

Implement verifyWebhookSignature(body, signature, secret, hmacSha256)

Every real webhook provider (Stripe, GitHub, ...) signs its payloads with HMAC so you can verify a request genuinely came from them, not an attacker who found your endpoint URL. In production you'd compute that digest with the Web Crypto API (crypto.subtle.sign("HMAC", ...)), but that API requires a secure browsing context, which this sandboxed practice runner deliberately isn't (it runs your code in an intentionally locked-down, origin-less iframe, the same isolation that keeps it safe to execute). So here, hmacSha256(secret, body) is injected as a parameter, a stand-in for whatever real digest function your backend would call, exactly like fetchJson takes fetch as a parameter instead of reaching for the global.

Write verifyWebhookSignature(body, signature, secret, hmacSha256) that:

1. Calls await hmacSha256(secret, body) to get the expected digest.
2. Prefixes it with "sha256=".
3. Returns true if that matches signature exactly, false otherwise.

await verifyWebhookSignature(rawBody, request.headers["x-signature"], secret, hmacSha256);