@antasphere/chassis-server 1.1.0 → 1.3.0

package/test/unit/webhook-match.test.ts

@@ -0,0 +1,81 @@
+import { describe, expect, it } from 'vitest';
+import { endpointWants, matchesEventType, matchesFilters } from '../../src/webhooks/match.js';
+
+/**
+ * The subscription rule (PRDCT-3482, verifier round 1, G7): an endpoint's
+ * event patterns against a type, its filters against the event's subjects.
+ */
+
+describe('matchesEventType', () => {
+  it('`*` matches every type', () => {
+    expect(matchesEventType(['*'], 'thing.created')).toBe(true);
+    expect(matchesEventType(['*'], 'webhook.ping')).toBe(true);
+  });
+
+  it('a family matches its own types only', () => {
+    expect(matchesEventType(['thing.*'], 'thing.created')).toBe(true);
+    expect(matchesEventType(['thing.*'], 'thing.deleted')).toBe(true);
+    expect(matchesEventType(['thing.*'], 'project.created')).toBe(false);
+    // A family is the whole segment before the dot, never a prefix of it.
+    expect(matchesEventType(['thing.*'], 'things.created')).toBe(false);
+    expect(matchesEventType(['thin.*'], 'thing.created')).toBe(false);
+  });
+
+  it('an exact type matches itself only', () => {
+    expect(matchesEventType(['thing.created'], 'thing.created')).toBe(true);
+    expect(matchesEventType(['thing.created'], 'thing.deleted')).toBe(false);
+  });
+
+  it('any of several patterns; none is no match', () => {
+    expect(matchesEventType(['project.created', 'thing.deleted'], 'thing.deleted')).toBe(true);
+    expect(matchesEventType(['project.created', 'thing.deleted'], 'thing.created')).toBe(false);
+    expect(matchesEventType([], 'thing.created')).toBe(false);
+  });
+});
+
+describe('matchesFilters', () => {
+  it('an empty filter matches everything, an event with no subject included', () => {
+    expect(matchesFilters({}, {})).toBe(true);
+    expect(matchesFilters({}, { thing: 't1' })).toBe(true);
+  });
+
+  it('a key with no ids is no constraint', () => {
+    expect(matchesFilters({ project: [] }, { thing: 't1' })).toBe(true);
+  });
+
+  it('OR within one key: any id matches, on a scalar or a list', () => {
+    expect(matchesFilters({ thing: ['t1', 't2'] }, { thing: 't2' })).toBe(true);
+    expect(matchesFilters({ thing: ['t1', 't2'] }, { thing: 't3' })).toBe(false);
+    expect(matchesFilters({ project: ['p9'] }, { project: ['p1', 'p9'] })).toBe(true);
+    expect(matchesFilters({ project: ['p9'] }, { project: ['p1', 'p2'] })).toBe(false);
+  });
+
+  it('AND across keys: every filtered key must match', () => {
+    const filters = { thing: ['t-a'], project: ['p-a'] };
+    expect(matchesFilters(filters, { thing: 't-a', project: ['p-a'] })).toBe(true);
+    expect(matchesFilters(filters, { thing: 't-a', project: ['p-b'] })).toBe(false);
+    expect(matchesFilters(filters, { thing: 't-b', project: ['p-a'] })).toBe(false);
+  });
+
+  it('an event missing a filtered subject does not match', () => {
+    expect(matchesFilters({ project: ['p1'] }, { thing: 't1' })).toBe(false);
+    expect(matchesFilters({ thing: ['t1'], project: ['p1'] }, { thing: 't1' })).toBe(false);
+  });
+});
+
+describe('endpointWants', () => {
+  const endpoint = { enabled: true, events: ['thing.*'], filters: { thing: ['t1'] } };
+
+  it('enabled, the type subscribed and the filters satisfied', () => {
+    expect(endpointWants(endpoint, 'thing.created', { thing: 't1' })).toBe(true);
+  });
+
+  it('a disabled endpoint wants nothing', () => {
+    expect(endpointWants({ ...endpoint, enabled: false }, 'thing.created', { thing: 't1' })).toBe(false);
+  });
+
+  it('the type unsubscribed, or the filters unmet, is no', () => {
+    expect(endpointWants(endpoint, 'project.created', { thing: 't1' })).toBe(false);
+    expect(endpointWants(endpoint, 'thing.created', { thing: 't2' })).toBe(false);
+  });
+});

package/test/unit/webhook-safe-fetch.test.ts

@@ -0,0 +1,330 @@
+import http from 'node:http';
+import type { AddressInfo } from 'node:net';
+import { Readable } from 'node:stream';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import {
+  checkWebhookUrl,
+  isPublicAddress,
+  safePost,
+  WebhookUrlRefusedError,
+  type SafeFetchPolicy,
+  type SafeTransport
+} from '../../src/webhooks/safe-fetch.js';
+
+/**
+ * The guarded webhook POST: a POST never reaches the instance's own network
+ * unless the operator opened it. Real local servers on 127.0.0.1 stand in
+ * for the receiver; the lookup and transport seams stand in for DNS.
+ */
+
+const CLOSED: SafeFetchPolicy = { allowPrivateNetworks: false, httpsOnly: false };
+const OPEN: SafeFetchPolicy = { allowPrivateNetworks: true, httpsOnly: false };
+const CLOUD: SafeFetchPolicy = { allowPrivateNetworks: false, httpsOnly: true };
+
+interface Seen {
+  method: string | undefined;
+  url: string | undefined;
+  headers: http.IncomingHttpHeaders;
+  body: string;
+}
+
+const seen: Seen[] = [];
+let base = '';
+const server = http.createServer((req, res) => {
+  const chunks: Buffer[] = [];
+  req.on('data', (c: Buffer) => chunks.push(c));
+  req.on('end', () => {
+    seen.push({
+      method: req.method,
+      url: req.url,
+      headers: req.headers,
+      body: Buffer.concat(chunks).toString('utf8')
+    });
+    if (req.url === '/redirect') {
+      res.writeHead(302, { location: '/target' });
+      res.end('moved');
+    } else if (req.url === '/silent') {
+      // never answers
+    } else if (req.url === '/big') {
+      res.writeHead(200, { 'content-type': 'text/plain' });
+      res.end('x'.repeat(200 * 1024));
+    } else {
+      res.writeHead(200, { 'content-type': 'text/plain' });
+      res.end('ok');
+    }
+  });
+});
+
+beforeAll(async () => {
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+});
+
+afterAll(async () => {
+  server.closeAllConnections();
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+});
+
+/** The URL checks refuse a non-default port, so the local server is reached through the transport seam. */
+function viaLocalServer(): SafeTransport {
+  return (url, init, signal) =>
+    new Promise((resolve, reject) => {
+      const req = http.request(
+        `${base}${url.pathname}${url.search}`,
+        { method: init.method, headers: init.headers, signal, agent: false },
+        (res) => resolve({ status: res.statusCode ?? 0, headers: res.headers, body: res })
+      );
+      req.on('error', reject);
+      req.end(init.body);
+    });
+}
+
+async function refusal(p: Promise<unknown>): Promise<string> {
+  try {
+    await p;
+  } catch (e) {
+    expect(e).toBeInstanceOf(WebhookUrlRefusedError);
+    return (e as WebhookUrlRefusedError).code;
+  }
+  throw new Error('expected a refusal');
+}
+
+function refusedSync(fn: () => unknown): string {
+  try {
+    fn();
+  } catch (e) {
+    expect(e).toBeInstanceOf(WebhookUrlRefusedError);
+    return (e as WebhookUrlRefusedError).code;
+  }
+  throw new Error('expected a refusal');
+}
+
+describe('isPublicAddress', () => {
+  it.each([
+    ['127.0.0.1', false],
+    ['10.1.2.3', false],
+    ['172.16.0.1', false],
+    ['172.31.255.255', false],
+    ['192.168.1.1', false],
+    ['169.254.169.254', false],
+    ['100.64.0.1', false],
+    ['0.0.0.0', false],
+    ['224.0.0.1', false],
+    ['::1', false],
+    ['::', false],
+    ['fe80::1', false],
+    ['fc00::1', false],
+    ['::ffff:127.0.0.1', false],
+    ['::ffff:8.8.8.8', true],
+    ['2002:7f00:1::', false],
+    ['2001:db8::1', false],
+    ['8.8.8.8', true],
+    ['2606:4700::1111', true],
+    ['nonsense', false]
+  ])('%s → %s', (ip, expected) => {
+    expect(isPublicAddress(ip)).toBe(expected);
+  });
+});
+
+describe('checkWebhookUrl', () => {
+  it('refuses a scheme other than http and https', () => {
+    expect(refusedSync(() => checkWebhookUrl('ftp://example.com/', CLOSED))).toBe('scheme');
+  });
+
+  it('refuses userinfo', () => {
+    expect(refusedSync(() => checkWebhookUrl('http://user:pw@example.com/', CLOSED))).toBe('userinfo');
+  });
+
+  it('refuses a port that is not the scheme default', () => {
+    expect(refusedSync(() => checkWebhookUrl('http://example.com:8080/', CLOSED))).toBe('port');
+    expect(refusedSync(() => checkWebhookUrl('https://example.com:80/', CLOSED))).toBe('port');
+  });
+
+  it('accepts any port once private networks are open (a LAN service on its own port)', () => {
+    expect(checkWebhookUrl('http://192.168.1.20:5678/webhook', OPEN).port).toBe('5678');
+    expect(checkWebhookUrl('http://example.com:8080/', OPEN).port).toBe('8080');
+  });
+
+  it('takes an explicit default port as the default (the parser drops it, the rule is url.port === "")', () => {
+    expect(checkWebhookUrl('http://example.com:80/', CLOSED).href).toBe('http://example.com/');
+    expect(checkWebhookUrl('https://example.com:443/', CLOSED).href).toBe('https://example.com/');
+  });
+
+  it('refuses a private literal address by default, accepts it when private networks are open', () => {
+    expect(refusedSync(() => checkWebhookUrl('http://127.0.0.1/', CLOSED))).toBe('private_address');
+    expect(refusedSync(() => checkWebhookUrl('http://[::1]/', CLOSED))).toBe('private_address');
+    expect(refusedSync(() => checkWebhookUrl('http://2130706433/', CLOSED))).toBe('private_address');
+    expect(checkWebhookUrl('http://127.0.0.1/', OPEN).hostname).toBe('127.0.0.1');
+  });
+
+  it('refuses http under httpsOnly and accepts https', () => {
+    expect(refusedSync(() => checkWebhookUrl('http://example.com/', CLOUD))).toBe('https_required');
+    expect(checkWebhookUrl('https://example.com/', CLOUD).href).toBe('https://example.com/');
+  });
+
+  it('refuses what is not a URL', () => {
+    expect(refusedSync(() => checkWebhookUrl('not a url', CLOSED))).toBe('malformed');
+  });
+});
+
+describe('safePost against a loopback receiver', () => {
+  it('refuses the loopback address by default, and the receiver never sees a request', async () => {
+    const before = seen.length;
+    // a literal loopback address, refused before any connection
+    expect(await refusal(safePost('http://127.0.0.1/hook', {}, '{}', CLOSED))).toBe('private_address');
+    // a name resolving to loopback, refused by the DEFAULT transport's socket lookup (no seam
+    // transport: the check that runs is the one inside node's connect)
+    const asked: string[] = [];
+    expect(
+      await refusal(
+        safePost('http://receiver.test/hook', {}, '{}', CLOSED, {
+          lookup: async (host) => {
+            asked.push(host);
+            return [{ address: '127.0.0.1', family: 4 }];
+          }
+        })
+      )
+    ).toBe('private_address');
+    expect(asked).toEqual(['receiver.test']);
+    expect(seen.length).toBe(before);
+  });
+
+  it('delivers when private networks are open: the method, the headers and the exact body', async () => {
+    const body = JSON.stringify({ event: 'thing.created', note: 'déjà vu' });
+    const result = await safePost(
+      'http://receiver.test/hook',
+      { 'content-type': 'application/json', 'x-signature': 'sig-1', 'Content-Length': '1' },
+      body,
+      OPEN,
+      { lookup: async () => [{ address: '127.0.0.1', family: 4 }], transport: viaLocalServer() }
+    );
+    expect(result.status).toBe(200);
+    expect(result.bodyText).toBe('ok');
+    expect(result.durationMs).toBeGreaterThanOrEqual(0);
+    const got = seen.at(-1)!;
+    expect(got.method).toBe('POST');
+    expect(got.url).toBe('/hook');
+    expect(got.body).toBe(body);
+    expect(got.headers['content-type']).toBe('application/json');
+    expect(got.headers['x-signature']).toBe('sig-1');
+    expect(got.headers['content-length']).toBe(String(Buffer.byteLength(body)));
+    expect(got.headers['user-agent']).toBeUndefined();
+  });
+
+  it('returns a 302 as its status and never requests the Location', async () => {
+    const before = seen.length;
+    const result = await safePost('http://receiver.test/redirect', {}, 'x', OPEN, {
+      lookup: async () => [{ address: '127.0.0.1', family: 4 }],
+      transport: viaLocalServer()
+    });
+    expect(result.status).toBe(302);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(seen.slice(before).map((s) => s.url)).toEqual(['/redirect']);
+  });
+
+  it('the REAL transport (no seam) answers a 302 as its status and never requests the Location (verifier round 1, G2)', async () => {
+    // A second loopback server is the Location's target: it must see nothing.
+    const targetSeen: string[] = [];
+    const target = http.createServer((req, res) => {
+      targetSeen.push(req.url ?? '');
+      res.writeHead(200);
+      res.end('followed');
+    });
+    await new Promise<void>((resolve) => target.listen(0, '127.0.0.1', resolve));
+    const targetUrl = `http://127.0.0.1:${(target.address() as AddressInfo).port}/target`;
+    const redirector = http.createServer((req, res) => {
+      req.resume();
+      req.on('end', () => {
+        res.writeHead(302, { location: targetUrl });
+        res.end('moved');
+      });
+    });
+    await new Promise<void>((resolve) => redirector.listen(0, '127.0.0.1', resolve));
+    const redirectorUrl = `http://127.0.0.1:${(redirector.address() as AddressInfo).port}/redirect`;
+    try {
+      // OPEN lifts the address rule and the port rule: the ephemeral ports are reached directly.
+      const result = await safePost(redirectorUrl, {}, 'x', OPEN, { timeoutMs: 2000 });
+      expect(result.status).toBe(302);
+      expect(result.bodyText).toBe('moved');
+      await new Promise((r) => setTimeout(r, 100));
+      expect(targetSeen).toEqual([]);
+    } finally {
+      for (const s of [redirector, target]) {
+        s.closeAllConnections();
+        await new Promise<void>((resolve) => s.close(() => resolve()));
+      }
+    }
+  });
+
+  it('a receiver that never answers: the timeout rejects with an abort error', async () => {
+    const started = Date.now();
+    const err = await safePost('http://receiver.test/silent', {}, 'x', OPEN, {
+      lookup: async () => [{ address: '127.0.0.1', family: 4 }],
+      transport: viaLocalServer(),
+      timeoutMs: 300
+    }).then(
+      () => null,
+      (e: unknown) => e as Error
+    );
+    expect(err).not.toBeNull();
+    expect(err).not.toBeInstanceOf(WebhookUrlRefusedError);
+    expect(['AbortError', 'TimeoutError']).toContain(err!.name);
+    expect(Date.now() - started).toBeLessThan(1000);
+  });
+
+  it('cuts the response body at maxResponseBytes and resolves promptly', async () => {
+    const started = Date.now();
+    const result = await safePost('http://receiver.test/big', {}, 'x', OPEN, {
+      lookup: async () => [{ address: '127.0.0.1', family: 4 }],
+      transport: viaLocalServer(),
+      maxResponseBytes: 1024
+    });
+    expect(result.status).toBe(200);
+    expect(result.bodyText.length).toBe(1024);
+    expect(Date.now() - started).toBeLessThan(1000);
+  });
+});
+
+describe('safePost through the lookup seam', () => {
+  let transportCalls = 0;
+  const transport: SafeTransport = async () => {
+    transportCalls++;
+    return { status: 200, headers: {}, body: Readable.from([Buffer.from('ok')]) };
+  };
+
+  it('refuses a name when ONE of its addresses is private', async () => {
+    transportCalls = 0;
+    const code = await refusal(
+      safePost('https://example.test/hook', {}, '{}', CLOSED, {
+        lookup: async () => [
+          { address: '93.184.216.34', family: 4 },
+          { address: '127.0.0.1', family: 4 }
+        ],
+        transport
+      })
+    );
+    expect(code).toBe('private_address');
+    expect(transportCalls).toBe(0);
+  });
+
+  it('refuses a name that resolves to nothing, even with private networks open', async () => {
+    transportCalls = 0;
+    for (const policy of [CLOSED, OPEN]) {
+      const code = await refusal(
+        safePost('https://example.test/hook', {}, '{}', policy, { lookup: async () => [], transport })
+      );
+      expect(code).toBe('unresolvable');
+    }
+    expect(transportCalls).toBe(0);
+  });
+
+  it('passes a name whose every address is public', async () => {
+    transportCalls = 0;
+    const result = await safePost('https://example.test/hook', {}, '{}', CLOUD, {
+      lookup: async () => [{ address: '93.184.216.34', family: 4 }],
+      transport
+    });
+    expect(result).toMatchObject({ status: 200, bodyText: 'ok' });
+    expect(transportCalls).toBe(1);
+  });
+});

package/test/unit/webhook-signing.test.ts

@@ -0,0 +1,169 @@
+import { describe, expect, it } from 'vitest';
+import {
+  generateWebhookSecret,
+  signWebhook,
+  SigningError,
+  verifyWebhookSignature,
+  WEBHOOK_SECRET_PREFIX,
+  webhookHeaders,
+  webhookSecretKey
+} from '../../src/webhooks/signing.js';
+
+/**
+ * Standard Webhooks, the symmetric v1 scheme. The vector is the one the
+ * reference libraries pin (standard-webhooks/standard-webhooks,
+ * libraries/javascript/src/webhook.test.ts and the python twin), so a receiver
+ * using any of them verifies what this signs.
+ */
+
+const VECTOR = {
+  secret: 'whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw',
+  id: 'msg_p5jXN8AQM9LWM0D4loKWxJek',
+  timestamp: 1614265330,
+  body: '{"test": 2432232314}',
+  signature: 'v1,g0hM9SsE+OTPJTGt/tmIKtSyZlE3uFJELVlNIOLJ1OE='
+};
+
+const NOW = VECTOR.timestamp;
+
+function headersOf(signature: string, id = VECTOR.id, timestamp = String(VECTOR.timestamp)) {
+  return { id, timestamp, signature };
+}
+
+describe('Standard Webhooks signing', () => {
+  it("reproduces the reference libraries' vector", () => {
+    expect(signWebhook([VECTOR.secret], VECTOR.id, VECTOR.timestamp, VECTOR.body)).toBe(VECTOR.signature);
+    expect(
+      verifyWebhookSignature(VECTOR.secret, headersOf(VECTOR.signature), VECTOR.body, { nowSeconds: NOW })
+    ).toBe(true);
+  });
+
+  it('generates a prefixed secret of 32 base64 characters holding 24 bytes', () => {
+    const secret = generateWebhookSecret();
+    expect(secret.startsWith(WEBHOOK_SECRET_PREFIX)).toBe(true);
+    const encoded = secret.slice(WEBHOOK_SECRET_PREFIX.length);
+    expect(encoded).toMatch(/^[A-Za-z0-9+/]{32}$/);
+    expect(Buffer.from(encoded, 'base64')).toHaveLength(24);
+    expect(webhookSecretKey(secret)).toHaveLength(24);
+    expect(generateWebhookSecret()).not.toBe(secret);
+  });
+
+  it('signs with two secrets as two entries, each verifying alone', () => {
+    const [a, b] = [generateWebhookSecret(), generateWebhookSecret()];
+    const header = signWebhook([a, b], VECTOR.id, NOW, VECTOR.body);
+    const entries = header.split(' ');
+    expect(entries).toHaveLength(2);
+    for (const entry of entries) expect(entry).toMatch(/^v1,[A-Za-z0-9+/]{43}=$/);
+    expect(entries[0]).toBe(signWebhook([a], VECTOR.id, NOW, VECTOR.body));
+    expect(entries[1]).toBe(signWebhook([b], VECTOR.id, NOW, VECTOR.body));
+    for (const secret of [a, b]) {
+      expect(verifyWebhookSignature(secret, headersOf(header), VECTOR.body, { nowSeconds: NOW })).toBe(true);
+    }
+    expect(
+      verifyWebhookSignature(generateWebhookSecret(), headersOf(header), VECTOR.body, { nowSeconds: NOW })
+    ).toBe(false);
+  });
+
+  it('builds the three headers and the content type', () => {
+    expect(webhookHeaders([VECTOR.secret], VECTOR.id, VECTOR.timestamp, VECTOR.body)).toEqual({
+      'webhook-id': VECTOR.id,
+      'webhook-timestamp': '1614265330',
+      'webhook-signature': VECTOR.signature,
+      'content-type': 'application/json'
+    });
+  });
+
+  it('fails on a changed body, id or timestamp', () => {
+    const verify = (headers: ReturnType<typeof headersOf>, body = VECTOR.body) =>
+      verifyWebhookSignature(VECTOR.secret, headers, body, { nowSeconds: NOW });
+    expect(verify(headersOf(VECTOR.signature), '{"test": 2432232315}')).toBe(false);
+    expect(verify(headersOf(VECTOR.signature), `${VECTOR.body} `)).toBe(false);
+    expect(verify(headersOf(VECTOR.signature, 'msg_p5jXN8AQM9LWM0D4loKWxJel'))).toBe(false);
+    expect(verify(headersOf(VECTOR.signature, VECTOR.id, String(VECTOR.timestamp + 1)))).toBe(false);
+    expect(verify(headersOf('v1,g0hM9SsE+OTPJTGt/tmIKtSyZlE3uFJELVlNIOLJ1OA='))).toBe(false);
+  });
+
+  it('fails on a timestamp older or newer than the tolerance, passes at its edge', () => {
+    const header = headersOf(VECTOR.signature);
+    const verifyAt = (nowSeconds: number, toleranceSeconds?: number) =>
+      verifyWebhookSignature(VECTOR.secret, header, VECTOR.body, {
+        nowSeconds,
+        ...(toleranceSeconds === undefined ? {} : { toleranceSeconds })
+      });
+    expect(verifyAt(NOW + 300)).toBe(true);
+    expect(verifyAt(NOW - 300)).toBe(true);
+    expect(verifyAt(NOW + 301)).toBe(false);
+    expect(verifyAt(NOW - 301)).toBe(false);
+    expect(verifyAt(NOW + 60, 30)).toBe(false);
+    expect(verifyAt(NOW + 60, 90)).toBe(true);
+    // The default clock is now: a 2021 timestamp is long stale.
+    expect(verifyWebhookSignature(VECTOR.secret, header, VECTOR.body)).toBe(false);
+  });
+
+  it('fails on a timestamp that is not whole unix seconds', () => {
+    for (const timestamp of ['', 'abc', '1614265330.0', '-1614265330', ' 1614265330', '1614265330000000']) {
+      expect(
+        verifyWebhookSignature(
+          VECTOR.secret,
+          headersOf(VECTOR.signature, VECTOR.id, timestamp),
+          VECTOR.body,
+          {
+            nowSeconds: NOW
+          }
+        )
+      ).toBe(false);
+    }
+  });
+
+  it('verifies a v1 entry beside a v2 entry, and ignores a lone v2 or a malformed entry', () => {
+    const v1 = VECTOR.signature.slice(3);
+    const verify = (signature: string) =>
+      verifyWebhookSignature(VECTOR.secret, headersOf(signature), VECTOR.body, { nowSeconds: NOW });
+    expect(verify(`v2,${v1} ${VECTOR.signature}`)).toBe(true);
+    expect(verify(`${VECTOR.signature} v2,AAAA`)).toBe(true);
+    expect(verify(`v1a,${v1}`)).toBe(false);
+    expect(verify(`v2,${v1}`)).toBe(false);
+    expect(verify(v1)).toBe(false);
+    expect(verify('')).toBe(false);
+  });
+
+  it('throws SigningError malformed_secret on a malformed secret', () => {
+    const malformed = [
+      'MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw', // no prefix
+      'whsk_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw', // wrong prefix
+      'whsec_', // nothing after the prefix
+      'whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaS', // a length that is not base64
+      'whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLa*w', // a character outside the alphabet
+      'whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLa_w', // base64url, not standard
+      'whsec_AAAAAAAAAAAAAAAAAAAAAA==', // 16 bytes, under the spec's 24
+      `whsec_${Buffer.alloc(65).toString('base64')}` // over the spec's 64
+    ];
+    for (const secret of malformed) {
+      let thrown: unknown;
+      try {
+        webhookSecretKey(secret);
+      } catch (error) {
+        thrown = error;
+      }
+      expect(thrown, secret).toBeInstanceOf(SigningError);
+      expect((thrown as SigningError).code).toBe('malformed_secret');
+      expect(() => signWebhook([secret], VECTOR.id, NOW, VECTOR.body)).toThrow(SigningError);
+      expect(() =>
+        verifyWebhookSignature(secret, headersOf(VECTOR.signature), VECTOR.body, { nowSeconds: NOW })
+      ).toThrow(SigningError);
+    }
+  });
+
+  it('refuses to sign with no secret, or with a timestamp that is not whole seconds', () => {
+    let thrown: unknown;
+    try {
+      signWebhook([], VECTOR.id, NOW, VECTOR.body);
+    } catch (error) {
+      thrown = error;
+    }
+    expect(thrown).toBeInstanceOf(SigningError);
+    expect((thrown as SigningError).code).toBe('no_secret');
+    expect(() => signWebhook([VECTOR.secret], VECTOR.id, NOW + 0.5, VECTOR.body)).toThrow(RangeError);
+    expect(() => signWebhook([VECTOR.secret], VECTOR.id, -1, VECTOR.body)).toThrow(RangeError);
+  });
+});