@beignet/core 0.0.37 → 0.0.39

package/src/uploads/index.ts

@@ -1036,6 +1036,7 @@ export function createUploadRouter<Ctx>(
       assertFiles(definition, intents, { requireChecksum: false });
 
       const completed: CompletedUploadFile[] = [];
+      const storedKeys: string[] = [];
       for (const [index, file] of webFiles.entries()) {
         const intent = intents[index];
         if (!intent) continue;
@@ -1072,18 +1073,24 @@ export function createUploadRouter<Ctx>(
           metadata: storageMetadata,
           visibility: definition.file.visibility ?? "private",
         });
+        storedKeys.push(key);
         const completedFile = {
           ...verifiedIntent,
           uploadId,
           key,
           object,
         };
-        await assertVerifiedFile(definition, {
-          ctx,
-          metadata,
-          file: completedFile,
-          storage: options.storage,
-        });
+        try {
+          await assertVerifiedFile(definition, {
+            ctx,
+            metadata,
+            file: completedFile,
+            storage: options.storage,
+          });
+        } catch (error) {
+          await cleanupRejectedServerUpload(uploadName, storedKeys);
+          throw error;
+        }
         completed.push(completedFile);
       }
 
@@ -1114,6 +1121,37 @@ export function createUploadRouter<Ctx>(
     }
   }
 
+  async function cleanupRejectedServerUpload(
+    uploadName: string,
+    keys: readonly string[],
+  ): Promise<void> {
+    const failures: Array<{ key: string; error: string }> = [];
+
+    await Promise.all(
+      keys.map(async (key) => {
+        try {
+          await options.storage.delete(key);
+        } catch (error) {
+          failures.push({
+            key,
+            error: error instanceof Error ? error.message : String(error),
+          });
+        }
+      }),
+    );
+
+    if (failures.length === 0) return;
+    instrumentation.custom({
+      name: "upload.server.cleanup.failed",
+      label: "Rejected upload cleanup failed",
+      summary: uploadName,
+      details: {
+        uploadName,
+        failures,
+      },
+    });
+  }
+
   function recordFailure(
     name: string,
     uploadName: string,

package/src/webhooks/index.ts

@@ -133,7 +133,8 @@ export type HmacWebhookTimestampFormat =
 export type HmacWebhookTimestampOptions =
   | {
       /**
-       * Header that carries the provider event timestamp.
+       * Header that carries the provider event timestamp. Header timestamps
+       * are authenticated as `<timestamp>.<rawBody>`.
        */
       header: string;
       payloadPath?: never;
@@ -461,7 +462,12 @@ export function createHmacWebhookVerifier(
         });
       }
 
-      const expected = await hmacHex(algorithm, options.secret, input.rawBody);
+      const signedBody = hmacSignedBody({
+        input,
+        provider: options.provider,
+        timestamp,
+      });
+      const expected = await hmacHex(algorithm, options.secret, signedBody);
       const actual = normalizeSignature(signature, options.signaturePrefix);
       if (!(await timingSafeStringEqual(actual, expected))) {
         throw new WebhookVerificationError({
@@ -573,6 +579,32 @@ function rawBodyText(rawBody: WebhookRawBody): string {
   return new TextDecoder().decode(rawBodyBytes(rawBody));
 }
 
+function hmacSignedBody(args: {
+  input: VerifyWebhookInput;
+  provider: string | undefined;
+  timestamp: NormalizedHmacTimestampOptions | undefined;
+}): WebhookRawBody {
+  if (!args.timestamp || args.timestamp.source === "payload") {
+    return args.input.rawBody;
+  }
+
+  const value = args.input.headers?.[args.timestamp.key];
+  if (value === undefined || value === null || value === "") {
+    throw new WebhookVerificationError({
+      message: `Missing ${args.timestamp.key} header.`,
+      provider: args.provider,
+      code: "missing_timestamp",
+    });
+  }
+
+  const prefix = new TextEncoder().encode(`${value}.`);
+  const body = rawBodyBytes(args.input.rawBody);
+  const signed = new Uint8Array(prefix.byteLength + body.byteLength);
+  signed.set(prefix);
+  signed.set(body, prefix.byteLength);
+  return signed;
+}
+
 function parseJsonBody(rawBody: WebhookRawBody): unknown {
   try {
     return JSON.parse(rawBodyText(rawBody));