noresponse 5.1.1 → 6.0.0

data/lib/no_response/webhooks.rb

@@ -1,264 +0,0 @@
-# typed: true
-# frozen_string_literal: true
-
-# Webhook verification. Hand-written beside the generated client.
-#
-# Verify the exact bytes received: the signature is HMAC-SHA256 over
-# "<timestamp>.<raw body>", so re-serialising parsed JSON breaks it.
-
-require 'json'
-require 'openssl'
-require 'time'
-
-module NoResponse
-  module Webhooks
-    DEFAULT_TOLERANCE_SECONDS = 300
-
-    REQUIRED = %w[nr-webhook-id nr-webhook-timestamp nr-webhook-key-id nr-webhook-signature].freeze
-    KEY_ID = /\Awhk_[A-Za-z0-9]{8,64}\z/
-    SIGNATURE = /\Av1=[0-9a-f]{64}\z/
-    TIMESTAMP = /\A[0-9]{1,12}\z/
-    CHALLENGE = /\A[A-Za-z0-9_-]{43}\z/
-    EVENT_ID = /\Aevt_[0-9A-HJKMNP-TV-Z]{26}\z/
-    ASSESSMENT_ID = /\Aasm_[0-9A-HJKMNP-TV-Z]{26}\z/
-    ACCOUNT_ID = /\A[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}\z/
-    ENDPOINT_ID = /\Awhe_[0-9A-HJKMNP-TV-Z]{26}\z/
-    WORKSPACE_ID = /\A[A-Za-z0-9][A-Za-z0-9_.-]{0,122}\z/
-
-    # Raised by construct_event. Answer 400 and do not process the delivery.
-    # code is one of :missing_header, :duplicate_header, :invalid_timestamp,
-    # :unknown_key, :invalid_signature or :invalid_payload.
-    class VerificationError < StandardError
-      attr_reader :code
-
-      def initialize(code, message)
-        super(message)
-        @code = code
-      end
-    end
-
-    # The final event for an assessment: it has expired and get now answers
-    # 404. assessment_version is the last served version.
-    AssessmentExpired = Struct.new(:assessment_id, :account_id, :assessment_version, keyword_init: true) do
-      def status = 'expired'
-      def change_reason = 'expired'
-    end
-
-    EndpointVerification = Struct.new(:endpoint_id, :challenge, keyword_init: true)
-
-    # An account you erased with accounts.delete: delete what you hold for it.
-    # assessments_deleted is at least 1, and deleted_at equals deleted_at in
-    # the delete answer.
-    AccountDeleted = Struct.new(:account_id, :assessments_deleted, :deleted_at, keyword_init: true)
-
-    # The workspace was deleted. Sent once per environment ("live" or "test")
-    # before its endpoints are torn down: the last event this endpoint receives.
-    WorkspaceDeleted = Struct.new(:workspace_id, :environment, :deleted_at, keyword_init: true)
-
-    # Another endpoint of this environment was disabled after failing
-    # continuously for 72 hours, since failing_since. It receives nothing more
-    # until it is verified again.
-    EndpointDisabled = Struct.new(:endpoint_id, :failing_since, :disabled_at, keyword_init: true)
-
-    # The account's decision for at least one flow changed. account is a
-    # Models::Shared::Account exactly as accounts.get returns it, with its new
-    # risk and decisions; previous_decisions_by_flow is a
-    # Models::Shared::AccountDecisionsByFlow holding the decisions it replaced.
-    # It is not sent when the score moves within the same decision, nor for an
-    # account's first risk.
-    AccountRiskChanged = Struct.new(:account, :previous_decisions_by_flow, keyword_init: true)
-
-    # A verified delivery. data is a Models::Shared::Assessment (exactly as
-    # assessments.get returns it) or an AssessmentExpired for type
-    # "assessment.updated", an EndpointVerification for
-    # "endpoint.verification", an AccountDeleted for "account.deleted", a
-    # WorkspaceDeleted for "workspace.deleted", an EndpointDisabled for
-    # "webhook_endpoint.disabled" and an AccountRiskChanged for
-    # "account.risk_changed". Deliveries are at least once and unordered:
-    # deduplicate on id and keep the highest detail.assessment_version.
-    Event = Struct.new(:id, :type, :created_at, :data, :test, keyword_init: true) do
-      # True for the terminal expiry event: delete what you hold and fetch nothing.
-      def expired? = data.is_a?(AssessmentExpired)
-
-      # True on an event sent by the send-test-event call: data is a fixed
-      # example assessment, not one of yours. Acknowledge it and apply nothing.
-      def test? = test == true
-    end
-
-    class << self
-
-      # Verify one delivery and return the typed Event.
-      #
-      # payload is the raw request body. headers is a Hash, Rack env-style
-      # pairs or any object with each; each NR-Webhook-* header must appear
-      # exactly once, in any letter case. secrets maps each whk_ key id
-      # NoResponse gave you to its secret; hold both during a rotation.
-      def construct_event(payload, headers, secrets, tolerance_seconds: DEFAULT_TOLERANCE_SECONDS, now: Time.now.to_i)
-        raw = payload.to_s.b
-        found = collect(headers)
-        timestamp = found['nr-webhook-timestamp']
-        if !TIMESTAMP.match?(timestamp) || (now.to_i - timestamp.to_i).abs > tolerance_seconds
-          raise VerificationError.new(:invalid_timestamp, 'Webhook timestamp is outside the replay window')
-        end
-
-        key_id = found['nr-webhook-key-id']
-        unless KEY_ID.match?(key_id) && secrets.key?(key_id)
-          raise VerificationError.new(:unknown_key, 'Webhook key id is not one this receiver holds')
-        end
-
-        signature = found['nr-webhook-signature']
-        raise VerificationError.new(:invalid_signature, 'Webhook signature is malformed') unless SIGNATURE.match?(signature)
-
-        expected = OpenSSL::HMAC.hexdigest('SHA256', secrets.fetch(key_id).to_s, "#{timestamp}.".b + raw)
-        unless OpenSSL.fixed_length_secure_compare(expected, signature.delete_prefix('v1='))
-          raise VerificationError.new(:invalid_signature, 'Webhook signature does not match')
-        end
-
-        event(raw, found['nr-webhook-id'])
-      end
-
-      # The body to answer an endpoint.verification event with, as JSON, status 200.
-      def verification_response(event)
-        unless event.data.is_a?(EndpointVerification)
-          raise VerificationError.new(:invalid_payload, 'Not an endpoint.verification event')
-        end
-
-        { 'challenge' => event.data.challenge }
-      end
-
-      private
-
-      def collect(headers)
-        found = {}
-        headers.each do |name, value|
-          key = name.to_s.downcase.tr('_', '-').delete_prefix('http-')
-          next unless REQUIRED.include?(key)
-
-          values = Array(value)
-          if values.length != 1 || found.key?(key)
-            raise VerificationError.new(:duplicate_header, "Webhook header #{key} is repeated")
-          end
-
-          found[key] = values.first.to_s
-        end
-        REQUIRED.each do |key|
-          raise VerificationError.new(:missing_header, "Webhook header #{key} is missing") if found[key].to_s.empty?
-        end
-        found
-      end
-
-      def event(raw, header_id)
-        body = begin
-          JSON.parse(raw)
-        rescue JSON::ParserError
-          raise VerificationError.new(:invalid_payload, 'Webhook body is not JSON')
-        end
-        unless body.is_a?(Hash) && body['id'] == header_id && EVENT_ID.match?(body['id'].to_s)
-          raise VerificationError.new(:invalid_payload, 'Webhook event id does not match NR-Webhook-Id')
-        end
-
-        data = body['data']
-        unless body['created_at'].is_a?(String) && valid_datetime?(body['created_at']) && data.is_a?(Hash)
-          raise VerificationError.new(:invalid_payload, 'Webhook event envelope is malformed')
-        end
-
-        Event.new(id: body['id'], type: body['type'], created_at: body['created_at'], data: event_data(body['type'], data),
-                  test: body['test'] == true && body['type'] == 'assessment.updated')
-      end
-
-      def event_data(type, data)
-        case type
-        when 'endpoint.verification'
-          unless ENDPOINT_ID.match?(data['endpoint_id'].to_s) && CHALLENGE.match?(data['challenge'].to_s)
-            raise VerificationError.new(:invalid_payload, 'Endpoint verification event is malformed')
-          end
-
-          EndpointVerification.new(endpoint_id: data['endpoint_id'], challenge: data['challenge'])
-        when 'assessment.updated'
-          return expired(data) if data['status'] == 'expired'
-          begin
-            Crystalline.unmarshal_json(data, Models::Shared::Assessment)
-          rescue KeyError, TypeError, ArgumentError, NoMethodError
-            raise VerificationError.new(:invalid_payload, 'Webhook data is not an assessment')
-          end
-        when 'account.deleted'
-          account_deleted(data)
-        when 'workspace.deleted'
-          workspace_deleted(data)
-        when 'webhook_endpoint.disabled'
-          endpoint_disabled(data)
-        when 'account.risk_changed'
-          account_risk_changed(data)
-        else
-          raise VerificationError.new(:invalid_payload, 'Unknown webhook event type')
-        end
-      end
-
-      def expired(data)
-        unless ASSESSMENT_ID.match?(data['assessment_id'].to_s) &&
-               ACCOUNT_ID.match?(data['account_id'].to_s) && data['assessment_version'].is_a?(Integer) &&
-               data['assessment_version'] >= 1 && data['status'] == 'expired' && data['change_reason'] == 'expired'
-          raise VerificationError.new(:invalid_payload, 'Expired assessment event is malformed')
-        end
-
-        AssessmentExpired.new(assessment_id: data['assessment_id'], account_id: data['account_id'],
-                              assessment_version: data['assessment_version'])
-      end
-
-      def account_deleted(data)
-        unless data['account_id'].is_a?(String) && ACCOUNT_ID.match?(data['account_id']) &&
-               data['assessments_deleted'].is_a?(Integer) && data['assessments_deleted'] >= 1 &&
-               data['deleted_at'].is_a?(String) && valid_datetime?(data['deleted_at'])
-          raise VerificationError.new(:invalid_payload, 'Account deleted event is malformed')
-        end
-
-        AccountDeleted.new(account_id: data['account_id'], assessments_deleted: data['assessments_deleted'],
-                           deleted_at: data['deleted_at'])
-      end
-
-      def workspace_deleted(data)
-        unless data['workspace_id'].is_a?(String) && WORKSPACE_ID.match?(data['workspace_id']) &&
-               %w[live test].include?(data['environment']) &&
-               data['deleted_at'].is_a?(String) && valid_datetime?(data['deleted_at'])
-          raise VerificationError.new(:invalid_payload, 'Workspace deleted event is malformed')
-        end
-
-        WorkspaceDeleted.new(workspace_id: data['workspace_id'], environment: data['environment'],
-                             deleted_at: data['deleted_at'])
-      end
-
-      def endpoint_disabled(data)
-        unless data['endpoint_id'].is_a?(String) && ENDPOINT_ID.match?(data['endpoint_id']) &&
-               data['failing_since'].is_a?(String) && valid_datetime?(data['failing_since']) &&
-               data['disabled_at'].is_a?(String) && valid_datetime?(data['disabled_at'])
-          raise VerificationError.new(:invalid_payload, 'Endpoint disabled event is malformed')
-        end
-
-        EndpointDisabled.new(endpoint_id: data['endpoint_id'], failing_since: data['failing_since'],
-                             disabled_at: data['disabled_at'])
-      end
-
-      def account_risk_changed(data)
-        account = data['account']
-        previous = data['previous_decisions_by_flow']
-        unless account.is_a?(Hash) && previous.is_a?(Hash) && account['id'].is_a?(String) && ACCOUNT_ID.match?(account['id'])
-          raise VerificationError.new(:invalid_payload, 'Account risk changed event is malformed')
-        end
-
-        begin
-          AccountRiskChanged.new(account: Crystalline.unmarshal_json(account, Models::Shared::Account),
-                                 previous_decisions_by_flow: Crystalline.unmarshal_json(previous, Models::Shared::AccountDecisionsByFlow))
-        rescue KeyError, TypeError, ArgumentError, NoMethodError
-          raise VerificationError.new(:invalid_payload, 'Account risk changed event is malformed')
-        end
-      end
-
-      def valid_datetime?(value)
-        Time.iso8601(value)
-        true
-      rescue ArgumentError
-        false
-      end
-    end
-  end
-end