axn-webhooks 0.1.0

data/lib/axn/webhooks/verifiers/hmac.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Axn
+  module Webhooks
+    module Verifiers
+      # Parametric HMAC strategy. Resolves each option against the request at verify time
+      # and delegates to the constant-time Signature primitive.
+      register(:hmac) do |secret:, signature:, signing_string: :raw_body, digest: :sha256,
+                          encoding: :hex, prefix: nil, replay: nil|
+        if replay
+          # Compare stringified keys so a HashWithIndifferentAccess (string keys) isn't
+          # misclassified as entirely unsupported.
+          allowed = %w[timestamp within unit]
+          unknown = replay.keys.reject { |key| allowed.include?(key.to_s) }
+          raise ArgumentError, "unsupported replay: key(s): #{unknown.map(&:inspect).join(', ')}" if unknown.any?
+
+          # Declaring `replay:` at all is an explicit request FOR replay protection, so a blank or
+          # non-positive `within:` is unambiguously a mistake — and one that silently disabled the
+          # guard rather than failing (security audit). Caught at boot, like every other declaration
+          # error, rather than on the first replayed request nobody notices.
+          within = replay[:within] || replay["within"]
+          unless within.is_a?(Numeric) && within.positive?
+            raise ArgumentError, "verify :hmac replay: `within:` must be a positive number of seconds (got #{within.inspect})"
+          end
+        end
+
+        # A literal secret is knowable now; a callable/Resolver is checked per request below.
+        literal_secret = !Resolvers.deferred?(secret)
+        Verifiers.require_secret!("verify :hmac", secret, error: ArgumentError) if literal_secret
+
+        lambda do |request|
+          timestamp = replay && Resolvers.resolve(replay.fetch(:timestamp), request)
+          # hmac_check (not hmac): Verify reads the returned Signature::Check to report WHY the
+          # request was rejected, so a replay-window miss is separable from an HMAC mismatch.
+          Signature.hmac_check(
+            # Resolve THEN guard, on every request: a resolver can miss (an unset env var, an
+            # absent header, a tenant lookup the ATTACKER names) long after boot, and "" is a legal
+            # HMAC key rather than a failure.
+            secret: Verifiers.require_secret!("verify :hmac", Resolvers.resolve(secret, request)),
+            payload: Resolvers.resolve(signing_string, request),
+            signature: Resolvers.resolve(signature, request),
+            digest:,
+            encoding:,
+            prefix:,
+            timestamp:,
+            # Omitted (not nil) when no replay is declared: Signature distinguishes "no replay
+            # check requested" from "a blank tolerance arrived from somewhere", and only the
+            # former is legitimate.
+            tolerance: replay ? replay.fetch(:within) { replay.fetch("within") } : Signature::NO_TOLERANCE,
+            # Default only when `unit:` is absent — an explicit `unit: nil`/`false` (e.g. an
+            # unset env var) must still hit Signature's ArgumentError, not silently become :auto.
+            unit: replay&.key?(:unit) ? replay[:unit] : Signature::AUTO,
+          )
+        end
+      end
+    end
+  end
+end

data/lib/axn/webhooks/verifiers/standard_webhooks.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+
+require "base64"
+
+module Axn
+  module Webhooks
+    module Verifiers
+      # Standard Webhooks (Svix) scheme. Secret is `whsec_<base64>`; the signed string is
+      # `id.timestamp.body`; the signature header holds space-separated `v1,<base64sig>`
+      # candidates; a ±tolerance replay window applies.
+      module StandardWebhooks
+        module_function
+
+        # NOT `secret.to_s` (Codex round-4 finding): coercing here is what turned a nil secret —
+        # an unset ENV var, or a `header(...)` resolver on an absent header — into "", which is
+        # valid Base64 and decodes to an EMPTY HMAC key. That is an authentication bypass, since
+        # anyone who knows the credential is missing can sign with the empty key. Callers must hand
+        # this a String; `secret_key` guards the type, and `require_secret_key!` is the safe entry
+        # point for anything resolved at request time.
+        def decode_secret(secret)
+          raise ArgumentError, "secret must be a String (got #{secret.class})" unless secret.is_a?(String)
+
+          Base64.strict_decode64(secret.delete_prefix("whsec_"))
+        end
+
+        # The raw key for a secret resolved at REQUEST time, raising if it isn't usable. Loud on
+        # purpose: a secret that has gone missing is a misconfiguration worth paging on, and must
+        # never degrade into a quiet :signature_mismatch that reads like a rotated key.
+        def require_secret_key!(secret)
+          secret_key(secret) || raise(Axn::Webhooks::Error, invalid_secret_message("verify :standard_webhooks", secret))
+        end
+
+        # The raw HMAC key behind a `whsec_<base64>` secret, or nil if the value isn't one.
+        # The single source of truth for "is this a usable Standard Webhooks secret", shared by
+        # inbound's declaration-time check and outbound's (Outbound::Signer), so the two can't drift.
+        #
+        # The `whsec_` prefix check is what carries this: an unprefixed secret is very often still
+        # VALID Base64 — a 32-char hex secret is, and that's a common shape — so it would decode
+        # silently to the wrong key rather than raising. The rescue is scoped to the decode alone;
+        # a caller that RESOLVES a secret (from a callable or a secret store) must do so outside
+        # this method, or its own ArgumentError would be swallowed and rewritten.
+        def secret_key(secret)
+          return nil unless secret.is_a?(String) && secret.start_with?("whsec_")
+
+          key = decode_secret(secret)
+          key.empty? ? nil : key
+        rescue ArgumentError
+          nil
+        end
+
+        # Describes a rejected secret's SHAPE for an error message, never its bytes: this can be
+        # raised per delivery attempt on the outbound side, and would otherwise flow the live
+        # signing credential into whatever Axn.config.on_exception is wired to.
+        def describe_secret(secret)
+          return secret.class.name unless secret.is_a?(String)
+          return "a #{secret.length}-char String not prefixed with whsec_" unless secret.start_with?("whsec_")
+
+          "a whsec_-prefixed String that failed to decode"
+        end
+
+        def invalid_secret_message(declaration, secret)
+          "#{declaration} secret must be a whsec_<base64> value (got #{describe_secret(secret)})"
+        end
+
+        # Keep only `v1,<sig>` candidates, stripped to the bare base64 signature.
+        # Done here (not via Signature's generic splitter) because that splitter treats
+        # the comma as a separator and would break `v1,<sig>` into two tokens.
+        def extract_v1(header)
+          header.to_s.split(/\s+/).select { |t| t.start_with?("v1,") }.map { |t| t.delete_prefix("v1,") }
+        end
+      end
+
+      register(:standard_webhooks) do |secret:, tolerance: 300,
+                                       id: Resolvers.header("webhook-id"),
+                                       timestamp: Resolvers.header("webhook-timestamp"),
+                                       signature: Resolvers.header("webhook-signature")|
+        # A LITERAL secret is fully knowable now, so the whsec_ format is checked once here (this
+        # block runs at `inbound` declaration) instead of failing every request forever. Symmetric
+        # with outbound `sign :standard_webhooks`, and ArgumentError for the same reason: a
+        # declaration mistake, not a runtime condition.
+        #
+        # Worth the eager check because BOTH request-time failure modes are near-undiagnosable: a
+        # non-Base64 raw secret raises (reported as a verifier crash, no `reason` on the result),
+        # and a raw secret that IS valid Base64 decodes silently to the wrong key — a quiet
+        # :signature_mismatch, nothing reported anywhere, indistinguishable from a rotated key.
+        #
+        # Exempt CALLABLES (a lambda, or a Resolver like `header("X-Secret")`) — deliberately not
+        # resolved here, since they may read a secret store or an env var set after boot, so their
+        # value stays a per-request concern. Everything ELSE is validated now.
+        #
+        # Keyed on respond_to?(:call), NOT on is_a?(String) (Codex round-3 finding): a `nil` secret
+        # — an unset ENV var being the obvious way to get one — is neither a String nor a callable,
+        # so a String-keyed check waved it through to request time, where `decode_secret` coerced it
+        # with #to_s and Base64-decoded "" into an EMPTY HMAC key. That is an authentication bypass,
+        # not a mismatch: anyone who knows the secret is unset can compute a signature with the empty
+        # key and be verified. Same fail-closed-on-blank stance verify :basic_auth already takes.
+        # An explicitly blank tolerance would silently disable the replay window; the 300s default
+        # applies only when the caller omits it entirely (security audit).
+        unless tolerance.is_a?(Numeric) && tolerance.positive?
+          raise ArgumentError,
+                "verify :standard_webhooks tolerance: must be a positive number of seconds (got #{tolerance.inspect})"
+        end
+
+        unless Resolvers.deferred?(secret) || StandardWebhooks.secret_key(secret)
+          raise ArgumentError, StandardWebhooks.invalid_secret_message("verify :standard_webhooks", secret)
+        end
+
+        lambda do |request|
+          ts = Resolvers.resolve(timestamp, request)
+          payload = "#{Resolvers.resolve(id, request)}.#{ts}.#{request.raw_body}"
+          candidates = StandardWebhooks.extract_v1(Resolvers.resolve(signature, request))
+
+          # hmac_check (not hmac): returns a Signature::Check so Verify can name the cause.
+          Signature.hmac_check(
+            # Resolve THEN validate. A declaration-time check can't cover this: a callable or
+            # Resolver is resolved fresh per request and can go missing at any point after boot.
+            secret: StandardWebhooks.require_secret_key!(Resolvers.resolve(secret, request)),
+            payload:,
+            signature: candidates.join(" "),
+            digest: :sha256,
+            encoding: :base64,
+            timestamp: ts,
+            tolerance:,
+          )
+        end
+      end
+    end
+  end
+end

data/lib/axn/webhooks/verifiers.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Axn
+  module Webhooks
+    # Builds a verifier callable (->(request){ Boolean }) from a `verify` declaration.
+    # A custom block is used verbatim; a strategy symbol is looked up in STRATEGIES
+    # (populated by verifiers/*.rb).
+    module Verifiers
+      STRATEGIES = {} # rubocop:disable Style/MutableConstant
+
+      module_function
+
+      def register(name, &builder) = STRATEGIES[name.to_sym] = builder
+
+      # THE shared secret guard. Every strategy in this gem routes its secret/credential through
+      # here, in both directions, so a new strategy cannot quietly reintroduce the bug this exists
+      # for — which has now recurred four times, each fix having been applied only where it was
+      # noticed (literal whsec_, resolved whsec_, `verify :hmac`, `verify :basic_auth`).
+      #
+      # The bug: a blank or absent secret is not a failure, it is a WEAK KEY. `""` is a perfectly
+      # legal HMAC key, so an empty secret makes the expected signature a value any stranger can
+      # compute — an authentication bypass, not a mismatch. `nil` happens to fail closed only by
+      # accident (OpenSSL raises TypeError on it), which is precisely why checking nil alone gives
+      # false confidence.
+      #
+      # Raises rather than returning false: a 401 meaning "we are misconfigured" is indistinguishable
+      # from one meaning "you are not the vendor", and would otherwise present as an unexplained
+      # outage. Names the value's TYPE or emptiness only — never its bytes, since this can fire on
+      # every request and would otherwise flow the live credential into logs and error trackers.
+      # `error:` follows this gem's misconfiguration split: ArgumentError for a DECLARATION mistake
+      # caught at boot, Axn::Webhooks::Error for a value that only goes bad at request time.
+      def require_secret!(declaration, value, label: "secret", error: Axn::Webhooks::Error)
+        return value if value.is_a?(String) && !value.empty?
+
+        raise error,
+              "#{declaration} #{label} must be a non-empty String " \
+              "(got #{value.is_a?(String) ? 'an empty String' : value.class})"
+      end
+
+      def build(strategy:, opts:, block:)
+        return block if block
+
+        builder = STRATEGIES.fetch(strategy&.to_sym) do
+          raise Axn::Webhooks::Error, "unknown verify strategy #{strategy.inspect}"
+        end
+        builder.call(**opts)
+      end
+    end
+  end
+end

data/lib/axn/webhooks/verify.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+module Axn
+  module Webhooks
+    # The verify stage, as an Axn. A signature mismatch is a quiet failure (`fail!` →
+    # 401 later, no on_exception page); a verifier that raises is a loud exception
+    # (reported to Axn.config.on_exception). The first two rows of the staged-outcome model.
+    class Verify
+      include Axn
+      include Axn::Webhooks::VendorFacet
+
+      # Why the request was rejected, keyed by Signature::REASONS. The HTTP response is a bare
+      # 401 in every case — this exists so the two causes are separable in logs and metrics
+      # (PRO-3141: a replay-window miss and an HMAC mismatch were byte-identical in the logs,
+      # and the replay case reported "signature mismatch" for a request whose signature was valid).
+      MESSAGES = {
+        replay_window: ->(check) { "replay window exceeded (timestamp skew #{check.skew}s)" },
+        replay_timestamp_invalid: ->(_check) { "replay timestamp missing or unparseable" },
+        signature_missing: ->(_check) { "signature missing" },
+        signature_mismatch: ->(_check) { "signature mismatch" },
+        # A genuine anomaly, and worth alerting on: the client presented an `Authorization` header,
+        # so it meant to authenticate, but not a Basic one. The bare handshake leg — which used to
+        # land here, once per *successful* webhook, making this the highest-volume value of the
+        # dimension — is answered with the challenge before Verify runs at all now (PRO-3148), so
+        # the message names what is actually left rather than the leg it no longer reports.
+        credentials_missing: lambda { |_check|
+          "no Basic credentials offered — a non-Basic Authorization scheme (the bare handshake leg " \
+            "is challenged before Verify)"
+        },
+        credentials_mismatch: ->(_check) { "Basic credentials rejected" },
+      }.freeze
+
+      expects :request, type: Axn::Webhooks::Request, sensitive: true
+      # A verifier closes over or holds the vendor's secret — that's its whole job — so it must
+      # never be rendered into the per-call log line. The built-in strategies redact themselves
+      # too (see Verifiers::BasicAuth#inspect), but this is the boundary that has to hold: a
+      # custom `verify` block or a future strategy can't be relied on to have thought about it.
+      expects :verifier, sensitive: true
+      exposes :reason, allow_blank: true, default: nil
+      exposes :skew, allow_blank: true, default: nil
+      exposes :suggested_unit, allow_blank: true, default: nil
+      # Deliberately mechanism-neutral: this prefixes every reason's message, and `verify :basic_auth`
+      # rejects requests on endpoints where no signature exists — "signature verification failed:
+      # Basic credentials rejected" would reintroduce, in the very first words an operator reads,
+      # the misdirection `reason` was added to end. The signature cases lose nothing, since their
+      # own half of the message still names the signature (see MESSAGES).
+      error "Webhook verification failed"
+
+      # A bounded enum (4 values), so unlike :vendor it's stamped unconditionally rather than
+      # gated behind Axn::Webhooks.config.vendor_facet — separating the causes is the reason
+      # this facet exists, and a default install needs it as much as a configured one.
+      # `from: :result` because the reason isn't known until the body has run.
+      dimension :reason, -> { @reason }, from: :result
+
+      # Also bounded (3 scales + absent), and set only when a pinned `unit:` — not a real replay —
+      # is what pushed the timestamp out of the window. Its presence alone splits the misconfigured
+      # half of :replay_window from the genuine half; its value names the fix (PRO-3142).
+      dimension :suggested_unit, -> { @suggested_unit }, from: :result
+
+      def call
+        check = verifier.call(request)
+        return if verified?(check)
+
+        # Set before fail! so the result-phase dimension resolvers can read them.
+        rejection = check.is_a?(Signature::Check) ? check : Signature::MISMATCH
+        @reason = rejection.reason
+        @skew = rejection.skew
+        @suggested_unit = rejection.suggested_unit
+        fail!(message_for(rejection), reason: @reason, skew: @skew, suggested_unit: @suggested_unit)
+      end
+
+      private
+
+      # The reason's own message, plus the suggested unit when one applies — "would fit as
+      # unit: :ms" alongside a 56-year skew names a misconfiguration outright, where the skew
+      # alone still reads as a possible replay. A timestamp is not a secret and the HTTP
+      # response is a bare 401 either way, so this discloses nothing to the sender.
+      def message_for(rejection)
+        message = MESSAGES.fetch(rejection.reason).call(rejection)
+        return message unless rejection.suggested_unit
+
+        "#{message} — would fit as unit: #{rejection.suggested_unit.inspect}"
+      end
+
+      # Anything that reports its OWN verdict via #ok? is asked; anything else (a custom verifier
+      # block, per the documented `->(request) { Boolean }` contract) is read for truthiness.
+      #
+      # Duck-typed on #ok? rather than `is_a?(Signature::Check)` because the truthiness fallback is
+      # a silent authentication-disabled bug for any verdict object: a REJECTING one is still a
+      # truthy Ruby object, so it verified and dispatched every rejected request while recording no
+      # verify failure anywhere. `Axn::Result` is the one that actually bites — in an axn-consuming
+      # app, returning `MyCheck.call(request:)` from a `verify` block is the obvious thing to write.
+      #
+      # Order matters: #ok? is asked FIRST, since every such object is truthy regardless of verdict.
+      # A truthy object with no #ok? still means verified — plenty of custom blocks end in a lookup
+      # returning a record rather than a boolean — and nil/false still mean rejected, since neither
+      # responds to #ok?.
+      #
+      # NOTE this reads the object's own notion of "ok", which for an Axn::Result means the action
+      # SUCCEEDED, not necessarily that the signature was valid. An action that returns ok while
+      # carrying its verdict in an exposure is still mis-read; see the README's custom-verify
+      # section. Fixing the always-verifies case does not make every Result shape safe.
+      def verified?(check) = check.respond_to?(:ok?) ? check.ok? : !!check
+    end
+  end
+end

data/lib/axn/webhooks/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Axn
+  module Webhooks
+    VERSION = "0.1.0"
+  end
+end

data/lib/axn/webhooks.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require "axn"
+require "active_support/deprecation"
+
+require_relative "webhooks/errors"
+require_relative "webhooks/handler"
+require_relative "webhooks/version"
+require_relative "webhooks/header_value"
+require_relative "webhooks/request"
+require_relative "webhooks/response"
+require_relative "webhooks/signature"
+require_relative "webhooks/resolvers"
+require_relative "webhooks/vendor_facet"
+require_relative "webhooks/verify"
+require_relative "webhooks/verifiers"
+require_relative "webhooks/verifiers/basic_auth"
+require_relative "webhooks/verifiers/hmac"
+require_relative "webhooks/verifiers/standard_webhooks"
+require_relative "webhooks/inbound"
+require_relative "webhooks/inbound/challenge"
+require_relative "webhooks/inbound/parsers"
+require_relative "webhooks/inbound/build_request"
+require_relative "webhooks/inbound/challenge_required"
+require_relative "webhooks/inbound/respond_context"
+require_relative "webhooks/respond"
+require_relative "webhooks/static_respond"
+require_relative "webhooks/dispatch"
+require_relative "webhooks/outbound"
+
+module Axn
+  module Webhooks
+    extend Axn::Configurable
+
+    # Per-gem config namespace (Axn::Configurable, PRO-2880), so settings declared here don't
+    # collide with another adapter configured on the same action.
+    config_namespace :webhooks
+
+    # Per-vendor observability facet (spec Decision 7 / PRO-2818). Off by default; a consuming app
+    # (Teamshares: :dimension) opts in. See Axn::Webhooks::VendorFacet for the runtime mechanism.
+    setting :vendor_facet, default: false, one_of: [false, :dimension, :tag]
+
+    # The HTTP status an inbound endpoint returns when a VERIFIED request's body doesn't parse
+    # (PRO-3143). 200 by default, because retrying can never fix a malformed body and 2xx is the only
+    # answer every vendor reads as "stop redelivering": Lob (5 days, then it disables the endpoint),
+    # Stripe, Slack and Shopify all retry non-2xx, and the last two also disable an endpoint after
+    # sustained failures — so a semantically-tidy 400 buys a retry loop from most senders. Set 400 for
+    # a vendor that does treat 4xx as terminal (honest status codes in their delivery dashboard), or
+    # 500 to restore the pre-PRO-3143 behavior. Per-endpoint override: `dispatch unparseable_status:`.
+    setting :unparseable_status,
+            default: 200,
+            validate: ->(value) { Response.valid_status?(value) || "must be an Integer HTTP status between 200 and 599" }
+
+    # A dedicated deprecator instance, so a consuming Rails app can register it
+    # (Rails.application.deprecators[:webhooks] = Axn::Webhooks.deprecator) and govern
+    # its behavior (silence in test, raise in CI, etc.).
+    def self.deprecator
+      @deprecator ||= ActiveSupport::Deprecation.new("1.0", "axn-webhooks")
+    end
+  end
+end

data/lib/axn-webhooks.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require_relative "axn/webhooks"

metadata

@@ -0,0 +1,128 @@
+--- !ruby/object:Gem::Specification
+name: axn-webhooks
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Kali Donovan
+bindir: exe
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: axn
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.0.pre.alpha.5
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 0.2.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.0.pre.alpha.5
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 0.2.0
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+description: 'Webhook handling for axn, both directions: verify/dispatch/acknowledge
+  inbound, and emit signed, self-retrying deliveries outbound. Rails-optional.'
+email:
+- kali@teamshares.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- DESIGN-NOTES.md
+- LICENSE.txt
+- README.md
+- lib/axn-webhooks.rb
+- lib/axn/webhooks.rb
+- lib/axn/webhooks/dispatch.rb
+- lib/axn/webhooks/errors.rb
+- lib/axn/webhooks/handler.rb
+- lib/axn/webhooks/header_value.rb
+- lib/axn/webhooks/inbound.rb
+- lib/axn/webhooks/inbound/build_request.rb
+- lib/axn/webhooks/inbound/challenge.rb
+- lib/axn/webhooks/inbound/challenge_required.rb
+- lib/axn/webhooks/inbound/dsl.rb
+- lib/axn/webhooks/inbound/endpoint.rb
+- lib/axn/webhooks/inbound/parsers.rb
+- lib/axn/webhooks/inbound/respond_context.rb
+- lib/axn/webhooks/inbound/router.rb
+- lib/axn/webhooks/outbound.rb
+- lib/axn/webhooks/outbound/callable_arity.rb
+- lib/axn/webhooks/outbound/config.rb
+- lib/axn/webhooks/outbound/deliver.rb
+- lib/axn/webhooks/outbound/dsl.rb
+- lib/axn/webhooks/outbound/emit.rb
+- lib/axn/webhooks/outbound/envelope.rb
+- lib/axn/webhooks/outbound/signer.rb
+- lib/axn/webhooks/outbound/subscriber.rb
+- lib/axn/webhooks/outbound/target_policy.rb
+- lib/axn/webhooks/outbound/transport.rb
+- lib/axn/webhooks/request.rb
+- lib/axn/webhooks/resolvers.rb
+- lib/axn/webhooks/respond.rb
+- lib/axn/webhooks/response.rb
+- lib/axn/webhooks/signature.rb
+- lib/axn/webhooks/static_respond.rb
+- lib/axn/webhooks/vendor_facet.rb
+- lib/axn/webhooks/verifiers.rb
+- lib/axn/webhooks/verifiers/basic_auth.rb
+- lib/axn/webhooks/verifiers/hmac.rb
+- lib/axn/webhooks/verifiers/standard_webhooks.rb
+- lib/axn/webhooks/verify.rb
+- lib/axn/webhooks/version.rb
+homepage: https://github.com/teamshares/axn-webhooks
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/teamshares/axn-webhooks
+  source_code_uri: https://github.com/teamshares/axn-webhooks
+  changelog_uri: https://github.com/teamshares/axn-webhooks/blob/main/CHANGELOG.md
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.2.1
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.8
+specification_version: 4
+summary: "Axn + webhooks = \U0001F525"
+test_files: []