@beignet/core 0.0.44 → 0.0.45

package/src/server/request-preparation.ts

@@ -52,6 +52,16 @@ class RequestBodyTooLargeError extends Error {
   }
 }
 
+class MalformedJsonBodyError extends Error {
+  readonly parseError: unknown;
+
+  constructor(parseError: unknown) {
+    super("Request body contains malformed JSON.");
+    this.name = "MalformedJsonBodyError";
+    this.parseError = parseError;
+  }
+}
+
 function contractDiagnostics(contract: HttpContractConfig) {
   return {
     contract: contract.name,
@@ -243,16 +253,15 @@ async function parseBody(
   if (contentType.includes("application/json")) {
     const text = await readLimitedRequestText(bodyReq, maxBytes);
     if (text === "") return undefined;
-    return JSON.parse(text);
+    try {
+      return JSON.parse(text);
+    } catch (error) {
+      throw new MalformedJsonBodyError(error);
+    }
   }
 
-  try {
-    const text = await readLimitedRequestText(bodyReq, maxBytes);
-    return text === "" ? undefined : text;
-  } catch (error) {
-    if (error instanceof RequestBodyTooLargeError) throw error;
-    return undefined;
-  }
+  const text = await readLimitedRequestText(bodyReq, maxBytes);
+  return text === "" ? undefined : text;
 }
 
 export async function prepareRequestInputs(args: {
@@ -364,9 +373,11 @@ export async function prepareRequestInputs(args: {
           contract,
           400,
           "INVALID_BODY",
-          "Malformed JSON",
+          error instanceof MalformedJsonBodyError
+            ? "Malformed JSON"
+            : "Could not read request body",
           "body",
-          error,
+          error instanceof MalformedJsonBodyError ? error.parseError : error,
         ),
       };
     }

package/src/server/use-case-route.ts

@@ -293,12 +293,17 @@ const USE_CASE_TRUSTED_RUN_KEY: unique symbol = Symbol.for(
   "beignet.useCase.trustedRun",
 );
 
+const USE_CASE_OUTPUT_VALIDATED_KEY: unique symbol = Symbol.for(
+  "beignet.useCase.outputValidated",
+);
+
 type RuntimeUseCase = AnyUseCaseLike & {
   run: (args: { ctx: unknown; input: unknown }) => Promise<unknown>;
   [USE_CASE_TRUSTED_RUN_KEY]?: (args: {
     ctx: unknown;
     input: unknown;
   }) => Promise<unknown>;
+  [USE_CASE_OUTPUT_VALIDATED_KEY]?: boolean;
 };
 
 /**
@@ -368,7 +373,8 @@ function computeResponseExemption(
   def: RuntimeUseCaseRouteDef,
   status: number,
 ): number | undefined {
-  return contract.responses[status] === def.useCase.outputSchema
+  return def.useCase[USE_CASE_OUTPUT_VALIDATED_KEY] === true &&
+    contract.responses[status] === def.useCase.outputSchema
     ? status
     : undefined;
 }

package/src/webhooks/index.ts

@@ -468,7 +468,10 @@ export function createHmacWebhookVerifier(
         timestamp,
       });
       const expected = await hmacHex(algorithm, options.secret, signedBody);
-      const actual = normalizeSignature(signature, options.signaturePrefix);
+      const actual = normalizeSignature(
+        signature,
+        options.signaturePrefix,
+      ).toLowerCase();
       if (!(await timingSafeStringEqual(actual, expected))) {
         throw new WebhookVerificationError({
           message: "Webhook signature is invalid.",