@adcp/sdk 13.0.0-rc.4 → 13.0.0-rc.6

package/dist/lib/core/SingleAgentClient.mjs

@@ -1306,6 +1306,14 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
           message: check.message
         };
       }
+    } else if (this.config.allowUnauthenticatedWebhooks === true) {
+      warnUnverifiedWebhookReceive();
+    } else {
+      return {
+        ok: false,
+        code: "webhook_unverifiable",
+        message: "Refusing an unauthenticated webhook: no `webhookSecret` is configured, so there is no signature to verify. Configure `webhookSecret` to enable HMAC verification, or set `allowUnauthenticatedWebhooks: true` to accept unverified webhooks (only safe when the receiver route is unreachable from outside your network)."
+      };
     }
     const payloadSource = this.config.webhookSecret && rawBody !== void 0 ? rawBody : options.payload ?? options.body ?? rawBody;
     const parsedPayload = parseWebhookBody(payloadSource);
@@ -2771,25 +2779,29 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         options
       );
       if (deliveryWebhookUrl) {
-        const libraryDefaults = {
-          url: deliveryWebhookUrl,
-          authentication: {
-            schemes: ["HMAC-SHA256"],
-            credentials: this.config.webhookSecret || "placeholder_secret_min_32_characters_required"
-          },
-          reporting_frequency: this.config.reportingWebhookFrequency || "daily"
-        };
-        params = {
-          ...params,
-          reporting_webhook: {
-            ...libraryDefaults,
-            ...params.reporting_webhook,
-            authentication: {
-              ...libraryDefaults.authentication,
-              ...params.reporting_webhook?.authentication
-            }
+        const consumerAuth = params.reporting_webhook?.authentication;
+        const defaultAuth = this.config.webhookSecret ? { schemes: ["HMAC-SHA256"], credentials: this.config.webhookSecret } : void 0;
+        if (!consumerAuth && !defaultAuth) {
+          if (params.reporting_webhook) {
+            throw new Error(
+              "reporting_webhook requires an `authentication` block for all of AdCP 3.x, and no credential is available: set `webhookSecret` on the client, or pass `reporting_webhook.authentication` explicitly. Remove `reporting_webhook` from the request if you do not need automated delivery reports \u2014 the media buy itself does not require it."
+            );
           }
-        };
+          warnReportingWebhookNeedsSecret();
+        } else {
+          const libraryDefaults = {
+            url: deliveryWebhookUrl,
+            reporting_frequency: this.config.reportingWebhookFrequency || "daily"
+          };
+          params = {
+            ...params,
+            reporting_webhook: {
+              ...libraryDefaults,
+              ...params.reporting_webhook,
+              authentication: consumerAuth ?? defaultAuth
+            }
+          };
+        }
       }
     }
     const result = await this.executeAndHandle(
@@ -4665,6 +4677,22 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
     return schemaMap[taskType] || null;
   }
 }
+let hasWarnedAboutUnverifiedWebhookReceive = false;
+function warnUnverifiedWebhookReceive() {
+  if (hasWarnedAboutUnverifiedWebhookReceive) return;
+  hasWarnedAboutUnverifiedWebhookReceive = true;
+  console.warn(
+    "[adcp] Webhook accepted WITHOUT authenticity verification: no `webhookSecret` is configured, so any caller able to reach this receiver can forge task completions and status changes. Configure `webhookSecret` to enable HMAC verification, and restrict network access to the receiver route."
+  );
+}
+let hasWarnedAboutReportingWebhookSecret = false;
+function warnReportingWebhookNeedsSecret() {
+  if (hasWarnedAboutReportingWebhookSecret) return;
+  hasWarnedAboutReportingWebhookSecret = true;
+  console.warn(
+    "[adcp] Skipping automatic `reporting_webhook` registration: AdCP 3.x requires an `authentication` block and no `webhookSecret` is configured. Set `webhookSecret` on the client, or pass an explicit `reporting_webhook.authentication` on the request. The media buy itself is unaffected."
+  );
+}
 function rawBodyFromUnknown(value) {
   return typeof value === "string" || Buffer.isBuffer(value) || value instanceof Uint8Array ? value : void 0;
 }