@bizjaya/finclient 0.1.1 → 0.2.0

package/dist/webhook.cjs

@@ -0,0 +1,49 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/webhook.ts
+var webhook_exports = {};
+__export(webhook_exports, {
+  FinWebhook: () => FinWebhook
+});
+module.exports = __toCommonJS(webhook_exports);
+var import_node_crypto = require("crypto");
+var FinWebhook = class {
+  static allowedSkewSeconds = 300;
+  /** Verify X-FinCopy-Signature over the timestamp and the exact raw request body. */
+  static verify(secret, timestamp, body, signature) {
+    if (!secret || !signature) return false;
+    const timestampText = String(timestamp);
+    if (!/^\d+$/.test(timestampText)) return false;
+    const seconds = Number(timestampText);
+    if (!Number.isSafeInteger(seconds)) return false;
+    const now = Math.floor(Date.now() / 1e3);
+    if (now - seconds > this.allowedSkewSeconds || seconds - now > this.allowedSkewSeconds) return false;
+    const suppliedHex = signature.startsWith("sha256=") ? signature.slice(7) : signature;
+    if (!/^[a-fA-F0-9]{64}$/.test(suppliedHex)) return false;
+    const supplied = Buffer.from(suppliedHex, "hex");
+    const signedBody = Buffer.isBuffer(body) ? body : Buffer.from(body);
+    const expected = (0, import_node_crypto.createHmac)("sha256", Buffer.from(secret, "utf8")).update(Buffer.from(`${timestampText}.`, "utf8")).update(signedBody).digest();
+    return supplied.length === expected.length && (0, import_node_crypto.timingSafeEqual)(supplied, expected);
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  FinWebhook
+});

package/dist/webhook.d.cts

@@ -0,0 +1,11 @@
+/**
+ * Verifies the HMAC-SHA256 signature on a FinCopy webhook request. Server-side (Node.js) only, so it is its own entry,
+ * `@bizjaya/finclient/webhook`, and the main entry stays free of Node built-ins for browsers.
+ */
+declare class FinWebhook {
+    private static readonly allowedSkewSeconds;
+    /** Verify X-FinCopy-Signature over the timestamp and the exact raw request body. */
+    static verify(secret: string, timestamp: string | number, body: string | Uint8Array, signature: string): boolean;
+}
+
+export { FinWebhook };

package/dist/webhook.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Verifies the HMAC-SHA256 signature on a FinCopy webhook request. Server-side (Node.js) only, so it is its own entry,
+ * `@bizjaya/finclient/webhook`, and the main entry stays free of Node built-ins for browsers.
+ */
+declare class FinWebhook {
+    private static readonly allowedSkewSeconds;
+    /** Verify X-FinCopy-Signature over the timestamp and the exact raw request body. */
+    static verify(secret: string, timestamp: string | number, body: string | Uint8Array, signature: string): boolean;
+}
+
+export { FinWebhook };

package/dist/webhook.js

@@ -0,0 +1,24 @@
+// src/webhook.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var FinWebhook = class {
+  static allowedSkewSeconds = 300;
+  /** Verify X-FinCopy-Signature over the timestamp and the exact raw request body. */
+  static verify(secret, timestamp, body, signature) {
+    if (!secret || !signature) return false;
+    const timestampText = String(timestamp);
+    if (!/^\d+$/.test(timestampText)) return false;
+    const seconds = Number(timestampText);
+    if (!Number.isSafeInteger(seconds)) return false;
+    const now = Math.floor(Date.now() / 1e3);
+    if (now - seconds > this.allowedSkewSeconds || seconds - now > this.allowedSkewSeconds) return false;
+    const suppliedHex = signature.startsWith("sha256=") ? signature.slice(7) : signature;
+    if (!/^[a-fA-F0-9]{64}$/.test(suppliedHex)) return false;
+    const supplied = Buffer.from(suppliedHex, "hex");
+    const signedBody = Buffer.isBuffer(body) ? body : Buffer.from(body);
+    const expected = createHmac("sha256", Buffer.from(secret, "utf8")).update(Buffer.from(`${timestampText}.`, "utf8")).update(signedBody).digest();
+    return supplied.length === expected.length && timingSafeEqual(supplied, expected);
+  }
+};
+export {
+  FinWebhook
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bizjaya/finclient",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Official TypeScript SDK for the FinCopy public API",
   "license": "MIT",
   "author": "BizJaya TechLab S/B",
@@ -25,6 +25,17 @@
         "default": "./dist/index.cjs"
       },
       "default": "./dist/index.js"
+    },
+    "./webhook": {
+      "import": {
+        "types": "./dist/webhook.d.ts",
+        "default": "./dist/webhook.js"
+      },
+      "require": {
+        "types": "./dist/webhook.d.cts",
+        "default": "./dist/webhook.cjs"
+      },
+      "default": "./dist/webhook.js"
     }
   },
   "files": [
@@ -39,7 +50,7 @@
   "scripts": {
     "generate:types": "openapi-typescript ../spec/fincopy-v1.json --output src/generated/schema.d.ts",
     "prepack": "node -e \"require('fs').copyFileSync('../LICENSE', 'LICENSE')\"",
-    "build": "tsup src/index.ts --format esm,cjs --dts --clean --target node18",
+    "build": "tsup src/index.ts src/webhook.ts --format esm,cjs --dts --clean --target node18",
     "typecheck": "tsc --noEmit",
     "test": "vitest run"
   },