text: // Sign and verify Watson Work requests and responses
  
  // Feel free to adapt to your particular security and hosting environment
  
  import { createHmac } from 'crypto';
  import debug from 'debug';
  
  // Debug log
  const log = debug('watsonwork-debug-sign');
  
  // Verify Watson Work request signature
  export const verify = (wsecret) => (req, res, buf, encoding) => {
    if(req.get('X-OUTBOUND-TOKEN') !==
      createHmac('sha256', wsecret).update(buf).digest('hex')) {
      log('Invalid request signature');
      const err = new Error('Invalid request signature');
      err.status = 401;
      throw err;
    }
  };
  
  // Handle Watson Work Webhook challenge requests
  export const challenge = (wsecret) => (req, res, next) => {
    if(req.body.type === 'verification') {
      log('Got Webhook verification challenge %o', req.body);
      const body = JSON.stringify({
        response: req.body.challenge
      });
      res.set('X-OUTBOUND-TOKEN',
        createHmac('sha256', wsecret).update(body).digest('hex'));
      res.type('json').send(body);
      return;
    }
    next();
  };
  