whop_sdk 1.0.12 → 1.0.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6b9d224f549b7e16ee1bb5de5d10d1a50706dbd1b746be4c450feeb700a160d5
-  data.tar.gz: 3429efb80021dc870ba0bc4c9599c4ca97efa2e4ad9ddce312e54dc2124f340e
+  metadata.gz: 9fc15ef6d359b6cf4784e9b9b4a43a677cd03a56bebe3b559dbf7ee65a611f21
+  data.tar.gz: 771adb6fcaf1b7564ee7383eead94c7a909a24522ddb0709f0c7e0f8cdfd35e4
 SHA512:
-  metadata.gz: 687fe8d7db55950f6a70e20fcbd4778ceeb6187290c6fc37dda4611b0f367b0626ca3a4a58832a13383fceb8f42eb63b602e0f6387308d7be0f4ae3bc2a397ea
-  data.tar.gz: 8f378d3b28200bf60ab53e36581482a8b7f79d5eb9529c5b652a1a57213c52d33be85ec2f0dfadbdb5d93b83ba5ba8382434c364e9c94e74e4ed244163796966
+  metadata.gz: 62de0ee7e2ea242700d78b8e87bbc6f60257328bb7834cc9c8e66eee3338b1ac7f2510c2ea1ca6847e516fe154490ee97f6f23b0e9b2137ab71a872d3e8c324c
+  data.tar.gz: a587e338a0c270925b9de6b890cf4112a924c4906c5003b90d53f9b29ed172a11f18519db16261e186157e4d6f4493350f46acb3670a0a9777bcebab944ae13a

data/.fernignore

@@ -20,25 +20,37 @@
 # one, so without this entry that history would disappear from the tree on the first
 # generated PR.
 #
-# lib/whop_sdk/helpers holds verify_user_token, the one hand-written helper in this SDK —
-# the x-whop-user-token verifier. It depends only on the standard library and the jwt gem,
-# never on generated client code, so it survives the client being replaced. This entry only
-# keeps the file: two things it needs are in Fern-owned files and are restored from the
-# generator config in whop-monorepo's sdks/fern/generators.yml, not from here.
-#
-#   - lib/whop_sdk.rb is regenerated, so the require_relative that loads the helper is lost.
-#     `requirePaths: [helpers/verify_user_token]` re-emits it as a File.exist?-guarded
-#     require_relative at the bottom of the generated lib/whop_sdk.rb.
-#   - whop_sdk.gemspec is regenerated, so `add_dependency "jwt"` is lost, the same way
-#     whopsdk-python's [user-tokens] extra does not survive. `extraDependencies: {jwt: ...}`
-#     re-declares it.
-#
-# Those two travel together. The helper does `require "jwt"` at load, so re-emitting the
-# require without the dependency turns a silently missing verifier into a LoadError on
-# `require "whop_sdk"` — the gem stops loading for everyone, not just user-token callers.
-# ci.yml asserts all three every run so a regeneration that drops any of them fails there
+# lib/whop_sdk/helpers holds the hand-written helpers in this SDK. Each depends only on the
+# standard library and one third-party gem, never on generated client code, so each survives
+# the client being replaced:
+#
+#   - verify_user_token — the x-whop-user-token verifier, on the jwt gem.
+#   - verify_webhook — the Standard Webhooks signature verifier, on the standardwebhooks gem.
+#     It restores the verification half of `client.webhooks.unwrap`, which the Stainless gem
+#     shipped through 0.0.41 and Fern cannot generate: Fern generates from OpenAPI paths and
+#     `unwrap` was never a path.
+#
+# This entry only keeps the files. Two things each helper needs are in Fern-owned files and
+# are restored from the generator config in whop-monorepo's sdks/fern/generators.yml, not
+# from here.
+#
+#   - lib/whop_sdk.rb is regenerated, so the require_relative that loads a helper is lost.
+#     `requirePaths: [helpers/verify_user_token, helpers/verify_webhook]` re-emits them as
+#     File.exist?-guarded require_relatives at the bottom of the generated lib/whop_sdk.rb.
+#   - whop_sdk.gemspec is regenerated, so `add_dependency "jwt"` and
+#     `add_dependency "standardwebhooks"` are lost, the same way whopsdk-python's
+#     [user-tokens] extra does not survive. `extraDependencies: {jwt: ..., standardwebhooks: ...}`
+#     re-declares them.
+#
+# The two travel together, per helper. Each helper requires its gem at load, so re-emitting
+# the require without the dependency turns a silently missing helper into a LoadError on
+# `require "whop_sdk"` — the gem stops loading for everyone, not just that helper's callers.
+# ci.yml asserts all of it every run so a regeneration that drops any of it fails there
 # instead of on a caller's machine.
 #
+# test/unit/helpers holds those helpers' tests. Fern owns test/, so without this entry a
+# regeneration would prune them and the helpers would go untested rather than fail loudly.
+#
 # lib/whop_sdk/internal/iterators/cursor_page_iterator.rb is a patched copy of a generated
 # file. The generated clients all pass cursor_field: :end_cursor, but the response models
 # declare end_cursor on page_info rather than at the root and Internal::Types::Model has no
@@ -60,3 +72,4 @@ CHANGELOG.md
 lib/whop_sdk/helpers
 lib/whop_sdk/internal/iterators/cursor_page_iterator.rb
 lib/whop_sdk/internal/types/utils.rb
+test/unit/helpers

data/lib/whop_sdk/helpers/verify_webhook.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require "base64"
+require "json"
+require "standardwebhooks"
+
+module WhopSDK
+  module Helpers
+    # Verifies the Standard Webhooks signature Whop sends on every webhook
+    # delivery, then parses the body.
+    #
+    # This is the verification half of the `client.webhooks.unwrap` the
+    # Stainless-generated gem shipped through 0.0.41. Fern generates from
+    # OpenAPI paths and `unwrap` was never a path, so the generated client has
+    # no equivalent. It is a standalone module rather than a method on the
+    # client so that nothing generated has to be patched: it depends only on
+    # the standardwebhooks gem and the standard library, never on generated
+    # client code, so it survives the client being replaced.
+    #
+    # What it does NOT do, and the Stainless version did: coerce the parsed
+    # body into one of 42 typed event models. Fern generates no webhook event
+    # models — `Whop_sdk::Types::WebhookEvent` is the enum of event *names* a
+    # webhook subscribes to, not a payload type — so there is nothing to coerce
+    # into. The parsed Hash is returned as-is.
+    module VerifyWebhook
+      MISSING_KEY_MESSAGE =
+        "Cannot verify a webhook without a key. Pass the endpoint's signing secret as `key:`."
+
+      # Verifies `payload` against the signature headers and returns the parsed body.
+      #
+      # @param payload [String] The raw, unmodified request body. Verifying a
+      #   re-serialized body fails: the signature covers the exact bytes sent.
+      # @param headers [Hash] The request headers. Only `webhook-id`,
+      #   `webhook-timestamp` and `webhook-signature` are read, and the lookup
+      #   is case-insensitive.
+      # @param key [String] The endpoint's signing secret, exactly as Whop
+      #   shows it — a `ws_`-prefixed string. Pass it verbatim; do not strip the
+      #   prefix and do not pre-encode it.
+      # @return [Hash] The parsed body, with symbol keys.
+      # @raise [ArgumentError] when `key` is missing or empty.
+      # @raise [StandardWebhooks::WebhookVerificationError] when a signature
+      #   header is missing, the timestamp is outside the tolerance window, or
+      #   no signature matches.
+      def self.unwrap(payload, headers:, key:)
+        raise ArgumentError, MISSING_KEY_MESSAGE if key.nil? || key.to_s.empty?
+
+        ::StandardWebhooks::Webhook.new(hmac_key(key)).verify(payload, downcased_headers(headers))
+        JSON.parse(payload, symbolize_names: true)
+      end
+
+      # Whop's backend HMACs with the *literal bytes* of the secret it issued
+      # (`WebhooksManager::SignWebhook` passes `webhook.webhook_secret` straight
+      # to `OpenSSL::HMAC`). `StandardWebhooks::Webhook` instead base64-decodes
+      # whatever it is handed to derive its key, so handing it the secret raw
+      # derives the wrong key and every genuine delivery fails to verify.
+      # Encoding here cancels that decode out, leaving exactly the bytes the
+      # backend signed with.
+      #
+      # The whole secret is encoded, prefix included, because the backend never
+      # strips a prefix either. That also disarms the library's own `whsec_`
+      # stripping: base64 output cannot begin with `whsec_`, since `_` is not in
+      # the base64 alphabet.
+      #
+      # @api private
+      def self.hmac_key(key)
+        Base64.strict_encode64(key.to_s)
+      end
+
+      # StandardWebhooks::Webhook#verify looks its three headers up by exact
+      # lowercase key, but HTTP header names are case-insensitive and a plain
+      # Rack/Sinatra headers Hash arrives capitalized.
+      #
+      # @api private
+      def self.downcased_headers(headers)
+        raise ArgumentError, "headers must be a Hash-like object of header names to values" unless headers.respond_to?(:each_pair)
+
+        headers.each_pair.with_object({}) do |(name, value), downcased|
+          downcased[name.to_s.downcase] = value
+        end
+      end
+    end
+  end
+end

data/lib/whop_sdk/internal/http/raw_client.rb

@@ -35,7 +35,7 @@ module Whop_sdk
           @default_headers = {
             "X-Fern-Language": "Ruby",
             "X-Fern-SDK-Name": "whop_sdk",
-            "X-Fern-SDK-Version": "1.0.12"
+            "X-Fern-SDK-Version": "1.0.13"
           }.merge(headers)
           @overridable_headers = overridable_headers.to_set { |name| name.to_s.downcase }
         end

data/lib/whop_sdk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Whop_sdk
-  VERSION = "1.0.12"
+  VERSION = "1.0.13"
 end

data/lib/whop_sdk.rb

@@ -3002,7 +3002,7 @@ require_relative "whop_sdk/environment"
 
 # Load user-defined files if present (e.g., for Sentry integration)
 # Files are loaded from lib/whop_sdk/ if they exist
-["whop_sdk/helpers/verify_user_token"].each do |relative_path|
+["whop_sdk/helpers/verify_user_token", "whop_sdk/helpers/verify_webhook"].each do |relative_path|
   absolute_path = File.join(__dir__, "#{relative_path}.rb")
   require_relative relative_path if File.exist?(absolute_path)
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: whop_sdk
 version: !ruby/object:Gem::Version
-  version: 1.0.12
+  version: 1.0.13
 platform: ruby
 authors:
 - Whop_sdk
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-22 00:00:00.000000000 Z
+date: 2026-08-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
@@ -24,6 +24,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '2.7'
+- !ruby/object:Gem::Dependency
+  name: standardwebhooks
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.0'
 description: The Whop_sdk Ruby library provides convenient access to the Whop_sdk
   API from Ruby.
 email:
@@ -886,6 +900,7 @@ files:
 - lib/whop_sdk/forums/types/update_forums_request.rb
 - lib/whop_sdk/forums/types/update_forums_request_banner_image.rb
 - lib/whop_sdk/helpers/verify_user_token.rb
+- lib/whop_sdk/helpers/verify_webhook.rb
 - lib/whop_sdk/identity_profiles/client.rb
 - lib/whop_sdk/identity_profiles/types/list_identity_profile_request.rb
 - lib/whop_sdk/identity_profiles/types/list_identity_profile_response.rb