noresponse 5.1.1 → 6.0.1

data/lib/no_response/models/shared/webhookendpointdisabledevent.rb

@@ -0,0 +1,70 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # The webhook_endpoint.disabled event.
+      class WebhookEndpointDisabledEvent
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # The event id, equal to the NR-Webhook-Id header and across redeliveries and every endpoint the event fans out to.
+        field :id, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("id"), required: true}}
+        # When the event was created. Equal across redeliveries; the signing timestamp header is per delivery.
+        field(
+          :created_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("created_at"), required: true}}
+        )
+        # One of the environment's endpoints stopped receiving events: every delivery attempt to it failed from failing_since until disabled_at, 72 hours or more. Its queued deliveries are dropped. Fix the receiver and verify it again with POST /v1/webhooks/{endpoint_id}/test (type endpoint.verification) to resume delivery.
+        field(
+          :data,
+          Models::Shared::WebhookEndpointDisabled,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("data"), required: true}}
+        )
+        # Always webhook_endpoint.disabled.
+        field :type, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("type"), required: true}}
+        # Present, and true, only on an event sent by POST /v1/webhooks/{endpoint_id}/test: its data is a fixed example assessment, not one of the workspace's, so a receiver acknowledges it and applies nothing. Real events have no test member.
+        field(
+          :test,
+          Crystalline::Nilable.new(Crystalline::Boolean.new),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("test")}}
+        )
+
+        sig {
+          params(
+            id: ::String,
+            created_at: ::String,
+            data: Models::Shared::WebhookEndpointDisabled,
+            type: ::String,
+            test: T.nilable(T::Boolean)
+          )
+            .void
+        }
+        def initialize(id:, created_at:, data:, type: "webhook_endpoint.disabled", test: nil)
+          @id = id
+          @created_at = created_at
+          @data = data
+          unless type == "webhook_endpoint.disabled"
+            raise ArgumentError, "Invalid value for type"
+          end
+
+          @type = "webhook_endpoint.disabled"
+          @test = test
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @id == other.id
+          return false unless @created_at == other.created_at
+          return false unless @data == other.data
+          return false unless @type == other.type
+          return false unless @test == other.test
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/webhookendpointdisabledevent.rbi

@@ -0,0 +1,38 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::WebhookEndpointDisabledEvent
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::WebhookEndpointDisabledEvent
+  def id
+  end
+
+  def id=(str_)
+  end
+
+  def created_at
+  end
+
+  def created_at=(str_)
+  end
+
+  def data
+  end
+
+  def data=(str_)
+  end
+
+  def type
+  end
+
+  def type=(str_)
+  end
+
+  def test
+  end
+
+  def test=(str_)
+  end
+end

data/lib/no_response/models/shared/webhookevent.rb

@@ -0,0 +1,23 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # The body of every webhook delivery: {id, type, created_at, data}, where type chooses the shape of data. Deliveries are at least once and unordered: deduplicate on id, and keep an assessment only when its detail.assessment_version is newer than the one you hold. GET /v1/assessments/{assessment_id} stays authoritative.
+      class WebhookEvent
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        def initialize
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/webhookevent.rbi

@@ -0,0 +1,9 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::WebhookEvent
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::WebhookEvent
+end

data/lib/no_response/models/shared/webhookverificationresponse.rb

@@ -0,0 +1,33 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # The body an endpoint returns, with status 200 and Content-Type application/json within 5 seconds, to an endpoint.verification event. A 2xx without the echoed challenge does not verify the endpoint.
+      class WebhookVerificationResponse
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # Endpoint verification nonce: 32 random bytes, unpadded base64url (43 characters). Fresh per verification.
+        field(
+          :challenge,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("challenge"), required: true}}
+        )
+
+        sig { params(challenge: ::String).void }
+        def initialize(challenge:)
+          @challenge = challenge
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @challenge == other.challenge
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/webhookverificationresponse.rbi

@@ -0,0 +1,14 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::WebhookVerificationResponse
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::WebhookVerificationResponse
+  def challenge
+  end
+
+  def challenge=(str_)
+  end
+end

data/lib/no_response/models/shared/workspacedeleted.rb

@@ -0,0 +1,55 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # Terminal for the receiving endpoint's environment: its workspace was deleted. Every key of the environment already answers 401, its assessments and accounts are gone, and no further event follows. The workspace id is not reused, so a later event naming it cannot arrive.
+      class WorkspaceDeleted
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # The workspace id, which is also its live environment's workspace id; the test environment's is the same id with :test appended. A workspace created through the API is tnt_ and a 26-character ULID.
+        field(
+          :workspace_id,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("workspace_id"), required: true}}
+        )
+        # The environment whose endpoints receive this event: live, or test for the workspace's test environment.
+        field(
+          :environment,
+          Models::Shared::Environment,
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("environment"),
+              required: true,
+              'decoder': ::NoResponse::Utils.enum_from_string(Models::Shared::Environment, false)
+            }
+          }
+        )
+        # When the deletion took effect, equal to deleted_at in the DELETE answer.
+        field(
+          :deleted_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("deleted_at"), required: true}}
+        )
+
+        sig { params(workspace_id: ::String, environment: Models::Shared::Environment, deleted_at: ::String).void }
+        def initialize(workspace_id:, environment:, deleted_at:)
+          @workspace_id = workspace_id
+          @environment = environment
+          @deleted_at = deleted_at
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @workspace_id == other.workspace_id
+          return false unless @environment == other.environment
+          return false unless @deleted_at == other.deleted_at
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/workspacedeleted.rbi

@@ -0,0 +1,26 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::WorkspaceDeleted
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::WorkspaceDeleted
+  def workspace_id
+  end
+
+  def workspace_id=(str_)
+  end
+
+  def environment
+  end
+
+  def environment=(str_)
+  end
+
+  def deleted_at
+  end
+
+  def deleted_at=(str_)
+  end
+end

data/lib/no_response/models/shared/workspacedeletedevent.rb

@@ -0,0 +1,70 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # The workspace.deleted event.
+      class WorkspaceDeletedEvent
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # The event id, equal to the NR-Webhook-Id header and across redeliveries and every endpoint the event fans out to.
+        field :id, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("id"), required: true}}
+        # When the event was created. Equal across redeliveries; the signing timestamp header is per delivery.
+        field(
+          :created_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("created_at"), required: true}}
+        )
+        # Terminal for the receiving endpoint's environment: its workspace was deleted. Every key of the environment already answers 401, its assessments and accounts are gone, and no further event follows. The workspace id is not reused, so a later event naming it cannot arrive.
+        field(
+          :data,
+          Models::Shared::WorkspaceDeleted,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("data"), required: true}}
+        )
+        # Always workspace.deleted.
+        field :type, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("type"), required: true}}
+        # Present, and true, only on an event sent by POST /v1/webhooks/{endpoint_id}/test: its data is a fixed example assessment, not one of the workspace's, so a receiver acknowledges it and applies nothing. Real events have no test member.
+        field(
+          :test,
+          Crystalline::Nilable.new(Crystalline::Boolean.new),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("test")}}
+        )
+
+        sig {
+          params(
+            id: ::String,
+            created_at: ::String,
+            data: Models::Shared::WorkspaceDeleted,
+            type: ::String,
+            test: T.nilable(T::Boolean)
+          )
+            .void
+        }
+        def initialize(id:, created_at:, data:, type: "workspace.deleted", test: nil)
+          @id = id
+          @created_at = created_at
+          @data = data
+          unless type == "workspace.deleted"
+            raise ArgumentError, "Invalid value for type"
+          end
+
+          @type = "workspace.deleted"
+          @test = test
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @id == other.id
+          return false unless @created_at == other.created_at
+          return false unless @data == other.data
+          return false unless @type == other.type
+          return false unless @test == other.test
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/workspacedeletedevent.rbi

@@ -0,0 +1,38 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::WorkspaceDeletedEvent
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::WorkspaceDeletedEvent
+  def id
+  end
+
+  def id=(str_)
+  end
+
+  def created_at
+  end
+
+  def created_at=(str_)
+  end
+
+  def data
+  end
+
+  def data=(str_)
+  end
+
+  def type
+  end
+
+  def type=(str_)
+  end
+
+  def test
+  end
+
+  def test=(str_)
+  end
+end

data/lib/no_response/models/shared.rb

@@ -7,8 +7,13 @@ module NoResponse
       autoload :Account, "no_response/models/shared/account.rb"
       autoload :AccountDecision, "no_response/models/shared/accountdecision.rb"
       autoload :AccountDecisionsByFlow, "no_response/models/shared/accountdecisionsbyflow.rb"
+      autoload :AccountDeleted, "no_response/models/shared/accountdeleted.rb"
+      autoload :AccountDeletedEvent, "no_response/models/shared/accountdeletedevent.rb"
       autoload :AccountDeletion, "no_response/models/shared/accountdeletion.rb"
+      autoload :AccountList, "no_response/models/shared/accountlist.rb"
       autoload :AccountRisk, "no_response/models/shared/accountrisk.rb"
+      autoload :AccountRiskChanged, "no_response/models/shared/accountriskchanged.rb"
+      autoload :AccountRiskChangedEvent, "no_response/models/shared/accountriskchangedevent.rb"
       autoload :AccountRiskReason, "no_response/models/shared/accountriskreason.rb"
       autoload :Assessment, "no_response/models/shared/assessment.rb"
       autoload :AssessmentDeletion, "no_response/models/shared/assessmentdeletion.rb"
@@ -16,6 +21,7 @@ module NoResponse
       autoload :AssessmentDetail, "no_response/models/shared/assessmentdetail.rb"
       autoload :AssessmentDetailAuthContext, "no_response/models/shared/assessmentdetailauthcontext.rb"
       autoload :AssessmentDetailTiming, "no_response/models/shared/assessmentdetailtiming.rb"
+      autoload :AssessmentExpired, "no_response/models/shared/assessmentexpired.rb"
       autoload :AssessmentList, "no_response/models/shared/assessmentlist.rb"
       autoload :AssessmentOutcome, "no_response/models/shared/assessmentoutcome.rb"
       autoload :AssessmentOutcomeRequest, "no_response/models/shared/assessmentoutcomerequest.rb"
@@ -25,6 +31,8 @@ module NoResponse
       autoload :AssessmentRequestIdentifiers, "no_response/models/shared/assessmentrequestidentifiers.rb"
       autoload :AssessmentRequestIssuedCredential, "no_response/models/shared/assessmentrequestissuedcredential.rb"
       autoload :AssessmentRequestPolicyContext, "no_response/models/shared/assessmentrequestpolicycontext.rb"
+      autoload :AssessmentUpdatedData, "no_response/models/shared/assessmentupdateddata.rb"
+      autoload :AssessmentUpdatedEvent, "no_response/models/shared/assessmentupdatedevent.rb"
       autoload :AssuranceLevel, "no_response/models/shared/assurancelevel.rb"
       autoload :AuthContext, "no_response/models/shared/authcontext.rb"
       autoload :AuthContextMfa, "no_response/models/shared/authcontextmfa.rb"
@@ -42,6 +50,15 @@ module NoResponse
       autoload :ConsistencyValue, "no_response/models/shared/consistencyvalue.rb"
       autoload :Country, "no_response/models/shared/country.rb"
       autoload :Depth, "no_response/models/shared/depth.rb"
+      autoload :EndpointVerification, "no_response/models/shared/endpointverification.rb"
+      autoload :EndpointVerificationEvent, "no_response/models/shared/endpointverificationevent.rb"
+      autoload :Enforcement, "no_response/models/shared/enforcement.rb"
+      autoload :EnforcementAction, "no_response/models/shared/enforcementaction.rb"
+      autoload :EnforcementProvider, "no_response/models/shared/enforcementprovider.rb"
+      autoload :EnforcementRequest, "no_response/models/shared/enforcementrequest.rb"
+      autoload :EnforcementState, "no_response/models/shared/enforcementstate.rb"
+      autoload :EnforcementStatus, "no_response/models/shared/enforcementstatus.rb"
+      autoload :Environment, "no_response/models/shared/environment.rb"
       autoload :Failure, "no_response/models/shared/failure.rb"
       autoload :FailureReason, "no_response/models/shared/failurereason.rb"
       autoload :Flow, "no_response/models/shared/flow.rb"
@@ -100,9 +117,12 @@ module NoResponse
       autoload :WebhookDeliveryList, "no_response/models/shared/webhookdeliverylist.rb"
       autoload :WebhookEndpoint, "no_response/models/shared/webhookendpoint.rb"
       autoload :WebhookEndpointCreated, "no_response/models/shared/webhookendpointcreated.rb"
+      autoload :WebhookEndpointDisabled, "no_response/models/shared/webhookendpointdisabled.rb"
+      autoload :WebhookEndpointDisabledEvent, "no_response/models/shared/webhookendpointdisabledevent.rb"
       autoload :WebhookEndpointList, "no_response/models/shared/webhookendpointlist.rb"
       autoload :WebhookEndpointRequest, "no_response/models/shared/webhookendpointrequest.rb"
       autoload :WebhookEndpointState, "no_response/models/shared/webhookendpointstate.rb"
+      autoload :WebhookEvent, "no_response/models/shared/webhookevent.rb"
       autoload :WebhookKeyRotation, "no_response/models/shared/webhookkeyrotation.rb"
       autoload :WebhookKeyRotationRequest, "no_response/models/shared/webhookkeyrotationrequest.rb"
       autoload :WebhookReplay, "no_response/models/shared/webhookreplay.rb"
@@ -110,6 +130,9 @@ module NoResponse
       autoload :WebhookTest, "no_response/models/shared/webhooktest.rb"
       autoload :WebhookTestRequest, "no_response/models/shared/webhooktestrequest.rb"
       autoload :WebhookTestRequestEvent, "no_response/models/shared/webhooktestrequestevent.rb"
+      autoload :WebhookVerificationResponse, "no_response/models/shared/webhookverificationresponse.rb"
+      autoload :WorkspaceDeleted, "no_response/models/shared/workspacedeleted.rb"
+      autoload :WorkspaceDeletedEvent, "no_response/models/shared/workspacedeletedevent.rb"
       autoload :AlternateName, "no_response/models/shared/alternate_name.rb"
       autoload :AlternateNameUnion, "no_response/models/shared/alternate_name_union.rb"
       autoload :Email, "no_response/models/shared/email.rb"

data/lib/no_response/sdk_hooks/registration.rb

@@ -10,7 +10,6 @@
 
 require_relative "./types"
 # Hand-written helpers beside the generated client, loaded with the gem.
-require_relative "../webhooks"
 require_relative "../wait"
 require_relative "../late_results"
 require_relative "idempotency_key_hook"

data/lib/no_response/sdkconfiguration.rb

@@ -95,9 +95,9 @@ module NoResponse
 
       @language = "ruby"
       @openapi_doc_version = "1"
-      @sdk_version = "5.1.1"
+      @sdk_version = "6.0.1"
       @gen_version = "internal"
-      @user_agent = "noresponse-sdk/ruby 5.1.1 internal 1 noresponse"
+      @user_agent = "noresponse-sdk/ruby 6.0.1 internal 1 noresponse"
     end
 
     sig { returns([String, T::Hash[Symbol, String]]) }

data/lib/no_response/webhook_verification.rb

@@ -0,0 +1,170 @@
+# typed: true
+# frozen_string_literal: true
+
+require "json"
+require "openssl"
+
+module NoResponse
+  # Verifies webhook deliveries and parses them into typed events.
+  module WebhookVerification
+    extend T::Sig
+
+    # How far the NR-Webhook-Timestamp header may be from the receiver's clock, in seconds.
+    DEFAULT_TOLERANCE_SECONDS = 300
+
+    # Raised by construct_event for a delivery that must not be processed:
+    # answer the delivery with a 400 and do not process it. code is one of
+    # "missing_header", "duplicate_header", "invalid_timestamp", "unknown_key",
+    # "invalid_signature" or "invalid_payload".
+    class VerificationError < StandardError
+      extend T::Sig
+
+      sig { returns(String) }
+      attr_reader :code
+
+      sig { params(code: String, message: String).void }
+      def initialize(code, message)
+        super("webhook verification failed: #{message} (#{code})")
+        @code = code
+      end
+    end
+
+    HEADER_NAMES = [
+      "NR-Webhook-Id",
+      "NR-Webhook-Timestamp",
+      "NR-Webhook-Key-Id",
+      "NR-Webhook-Signature"
+    ].freeze
+    private_constant :HEADER_NAMES
+    EVENT_TYPE = Crystalline::DiscriminatedUnion.new(
+      "type",
+      {
+        "assessment.updated" => Models::Shared::AssessmentUpdatedEvent,
+        "endpoint.verification" => Models::Shared::EndpointVerificationEvent,
+        "account.deleted" => Models::Shared::AccountDeletedEvent,
+        "workspace.deleted" => Models::Shared::WorkspaceDeletedEvent,
+        "webhook_endpoint.disabled" => Models::Shared::WebhookEndpointDisabledEvent,
+        "account.risk_changed" => Models::Shared::AccountRiskChangedEvent
+      }
+    )
+    private_constant :EVENT_TYPE
+
+    class << self
+      extend T::Sig
+
+      # Verifies a webhook delivery and parses its body.
+      #
+      # payload is the raw request body exactly as received: re-encoding parsed JSON breaks the signature.
+      # headers is a Hash, or an Array of name/value pairs, whose values are Strings or Arrays of Strings.
+      # A header repeated in any letter case, or sent as a comma-joined list, is refused.
+      # secrets maps each key id, sent in NR-Webhook-Key-Id, to its secret, so a receiver can hold two during a rotation.
+      # now is the receiver's clock (a Time or Unix seconds) used for the tolerance check.
+      sig do
+        params(
+          payload: String,
+          headers: T::Enumerable[T.untyped],
+          secrets: T::Hash[String, String],
+          tolerance_seconds: Integer,
+          now: T.nilable(T.any(Time, Integer))
+        )
+          .returns(
+            T.any(
+              Models::Shared::AssessmentUpdatedEvent,
+              Models::Shared::EndpointVerificationEvent,
+              Models::Shared::AccountDeletedEvent,
+              Models::Shared::WorkspaceDeletedEvent,
+              Models::Shared::WebhookEndpointDisabledEvent,
+              Models::Shared::AccountRiskChangedEvent
+            )
+          )
+      end
+      def construct_event(payload, headers, secrets, tolerance_seconds: DEFAULT_TOLERANCE_SECONDS, now: nil)
+        raw = payload.b
+        values = header_values(headers)
+        id = values.fetch("NR-Webhook-Id")
+        timestamp = values.fetch("NR-Webhook-Timestamp")
+        key_id = values.fetch("NR-Webhook-Key-Id")
+        signature = values.fetch("NR-Webhook-Signature")
+
+        unless timestamp.match?(/\A[0-9]{1,12}\z/)
+          raise VerificationError.new("invalid_timestamp", "NR-Webhook-Timestamp is not a Unix time in seconds")
+        end
+
+        if ((now || Time.now).to_i - timestamp.to_i).abs > tolerance_seconds
+          raise VerificationError.new("invalid_timestamp", "NR-Webhook-Timestamp is outside the tolerance")
+        end
+
+        unless secrets.key?(key_id)
+          raise VerificationError.new("unknown_key", "NR-Webhook-Key-Id names a key this receiver does not hold")
+        end
+
+        secret = secrets.fetch(key_id)
+        raise VerificationError.new("invalid_signature", "the webhook secret is empty") if secret.empty?
+
+        received = decode_signature(signature)
+        substitutions = {"{timestamp}" => timestamp, "{id}" => id}
+        signed = "{timestamp}.".gsub(/\{(?:timestamp|id)\}/, substitutions).b + raw
+        expected = OpenSSL::HMAC.digest("SHA256", secret, signed)
+        unless received.bytesize == expected.bytesize && OpenSSL.fixed_length_secure_compare(expected, received)
+          raise VerificationError.new("invalid_signature", "NR-Webhook-Signature does not match")
+        end
+
+        body = begin
+          JSON.parse(raw)
+        rescue JSON::ParserError, EncodingError
+          raise VerificationError.new("invalid_payload", "the body is not JSON")
+        end
+
+        unless body.is_a?(::Hash) && body["id"].is_a?(::String) && body["id"] == id
+          raise VerificationError.new("invalid_payload", "the body's id does not equal NR-Webhook-Id")
+        end
+
+        event = begin
+          Crystalline.unmarshal_json(body, EVENT_TYPE)
+        rescue StandardError
+          nil
+        end
+
+        if event.nil? || Crystalline.unknown?(event)
+          raise VerificationError.new("invalid_payload", "the body is not a known webhook event")
+        end
+
+        event
+      end
+
+      private
+
+      sig { params(headers: T::Enumerable[T.untyped]).returns(T::Hash[String, String]) }
+      def header_values(headers)
+        HEADER_NAMES.to_h do |name|
+          found = T.let([], T::Array[String])
+          headers.each do |key, value|
+            found.concat(Array(value).map(&:to_s)) if key.to_s.casecmp?(name)
+          end
+
+          if found.length > 1 || found.first&.include?(",")
+            raise VerificationError.new("duplicate_header", "#{name} is repeated")
+          end
+
+          raise VerificationError.new("missing_header", "#{name} is missing") if found.first.to_s.empty?
+
+          [name, found.first.to_s]
+        end
+      end
+
+      sig { params(signature: String).returns(String) }
+      def decode_signature(signature)
+        encoded = signature.delete_prefix("v1=")
+        if encoded.length == signature.length
+          raise VerificationError.new("invalid_signature", "NR-Webhook-Signature is malformed")
+        end
+
+        unless encoded.match?(/\A(?:[0-9a-fA-F]{2})*\z/)
+          raise VerificationError.new("invalid_signature", "NR-Webhook-Signature is malformed")
+        end
+
+        [encoded].pack("H*")
+      end
+    end
+  end
+end

data/lib/noresponse.rb

@@ -16,6 +16,8 @@ module NoResponse
     autoload :Errors, "no_response/models/errors"
     autoload :Callbacks, "no_response/models/callbacks"
   end
+
+  autoload :WebhookVerification, "no_response/webhook_verification"
 end
 
 require_relative "no_response/utils/utils"