Forward SMS to another number automatically

import { createHmac, timingSafeEqual } from 'node:crypto'
import { createServer } from 'node:http'

const SECRET = process.env.TEXTBEE_WEBHOOK_SECRET
if (!SECRET) throw new Error('Set TEXTBEE_WEBHOOK_SECRET')
const API_KEY = process.env.TEXTBEE_API_KEY
const BASE_URL = process.env.TEXTBEE_BASE_URL ?? 'https://api.textbee.dev/api/v1'
const FORWARD_TO = process.env.FORWARD_TO
const MAX_BODY = 64 * 1024
const seen = new Set() // use your database in production

// Compare digits only, since the phone can report a number in national format.
function lastDigits(number) {
  return String(number).replace(/\D/g, '').slice(-9)
}

async function forward(event) {
  // Never forward the forwarding number's own texts, or two relays can loop.
  if (lastDigits(event.sender) === lastDigits(FORWARD_TO)) return

  const response = await fetch(`${BASE_URL}/gateway/send-sms`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json', 'x-api-key': API_KEY },
    signal: AbortSignal.timeout(20_000),
    body: JSON.stringify({
      deviceId: event.deviceId, // send from the phone that received the text
      recipients: [FORWARD_TO],
      message: `From ${event.sender}: ${event.message}`,
    }),
  })
  if (!response.ok) throw failure('textbee', response.status)
}

// A 4xx other than 408 or 429 will not fix itself, so it is logged instead of retried.
function failure(name, status) {
  const error = new Error(`${name} answered ${status}`)
  error.permanent = status >= 400 && status < 500 && status !== 408 && status !== 429
  return error
}

function verified(rawBody, signature = '') {
  const expected = Buffer.from(createHmac('sha256', SECRET).update(rawBody).digest('hex'))
  const received = Buffer.from(signature)
  return received.length === expected.length && timingSafeEqual(received, expected)
}

createServer((request, response) => {
  const chunks = []
  let size = 0
  request.on('data', (chunk) => {
    size += chunk.length
    if (size <= MAX_BODY) chunks.push(chunk)
  })
  request.on('end', async () => {
    if (size > MAX_BODY) return response.writeHead(413).end()
    const rawBody = Buffer.concat(chunks)
    if (!verified(rawBody, request.headers['x-signature'])) return response.writeHead(401).end()

    const event = JSON.parse(rawBody.toString())
    if (event.webhookEvent !== 'MESSAGE_RECEIVED' || seen.has(event.idempotencyKey)) {
      return response.writeHead(200).end()
    }

    try {
      await forward(event)
      seen.add(event.idempotencyKey)
      response.writeHead(200).end()
    } catch (error) {
      console.error(error.message)
      // 502 makes textbee retry the delivery; a permanent failure is not worth retrying.
      response.writeHead(error.permanent ? 200 : 502).end()
    }
  })
}).listen(process.env.PORT ?? 3000)