@aiacta-org/ai-citation-sdk 1.0.7 → 1.0.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiacta-org/ai-citation-sdk",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Webhook receiver SDK for AIACTA citation events. HMAC-SHA256 signature verification, idempotency, and Express middleware (AIACTA Proposal 2, §3.4)",
   "author": "Eric Michel",
   "license": "Apache-2.0",

package/src/node/signature.js

@@ -16,13 +16,29 @@ const TIMESTAMP_TOLERANCE_SECONDS = 300; // 5 minutes (§3.4)
  * @throws {Error} if timestamp is outside tolerance window
  */
 function verifyWebhookSignature(payload, timestamp, sigHeader, secret) {
+  if (!secret || typeof sigHeader !== 'string' || !sigHeader.startsWith('sha256=')) {
+    return false;
+  }
+
+  const parsedTimestamp = parseInt(timestamp, 10);
+  if (!Number.isFinite(parsedTimestamp)) {
+    return false;
+  }
+
   const now = Math.floor(Date.now() / 1000);
-  if (Math.abs(now - parseInt(timestamp, 10)) > TIMESTAMP_TOLERANCE_SECONDS) {
+  if (Math.abs(now - parsedTimestamp) > TIMESTAMP_TOLERANCE_SECONDS) {
     throw new Error('Timestamp outside tolerance window — possible replay attack');
   }
-  const signedPayload = `${timestamp}.${payload}`;
+
+  const received = sigHeader.slice('sha256='.length);
+  if (!/^[0-9a-f]{64}$/i.test(received)) {
+    return false;
+  }
+
+  const body = Buffer.isBuffer(payload) ? payload : Buffer.from(String(payload));
+  const signedPayload = Buffer.concat([Buffer.from(`${timestamp}.`), body]);
   const expected = crypto.createHmac('sha256', secret).update(signedPayload).digest('hex');
-  const received  = sigHeader.replace('sha256=', '');
+
   // Constant-time comparison to prevent timing attacks
   return crypto.timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(received, 'hex'));
 }

package/src/python/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name='ai-citation-sdk',
-    version='1.0.7',
+    version='1.0.8',
     description='AIACTA Citation Webhook SDK for Python — signature verification, idempotency, and retry handling (Proposal 2, §3.4)',
     long_description=open('../../README.md', encoding='utf-8').read() if __import__('os').path.exists('../../README.md') else '',
     long_description_content_type='text/markdown',

package/tests/signature.test.js

@@ -24,3 +24,17 @@ test('old timestamp throws', () => {
   const oldTs = String(Math.floor(Date.now() / 1000) - 400);
   expect(() => verifyWebhookSignature('{}', oldTs, 'sha256=abc', 'secret')).toThrow();
 });
+
+test('missing signature header returns false', () => {
+  const ts = String(Math.floor(Date.now() / 1000));
+  expect(verifyWebhookSignature('{}', ts, undefined, 'secret')).toBe(false);
+});
+
+test('malformed signature header returns false', () => {
+  const ts = String(Math.floor(Date.now() / 1000));
+  expect(verifyWebhookSignature('{}', ts, 'sha256=not-hex', 'secret')).toBe(false);
+});
+
+test('non-numeric timestamp returns false', () => {
+  expect(verifyWebhookSignature('{}', 'not-a-timestamp', 'sha256=abc', 'secret')).toBe(false);
+});