@businessdash/sdk 0.9.60

package/src/reserved-paths.ts

@@ -0,0 +1,65 @@
+/**
+ * Page paths reserved by the BIAB platform. These routes are served by
+ * BIAB on every verified org hostname (`pay.acme.com/quotes/accept/<token>`,
+ * `acme.com/contracts/sign/<token>`, etc.), so a marketing page declared at
+ * one of these paths would collide and silently break customer-facing
+ * accept / sign / pay flows.
+ *
+ * Keep in sync with the server-side mirror at
+ * `src/server/sites/reserved-page-paths.ts` (same list, same semantics).
+ */
+export const RESERVED_PAGE_PATHS = [
+	// Quote accept (public review/accept page from emailed quotes)
+	"quotes",
+	"quotes/accept",
+	// Contract signing (public signing page from emailed contracts)
+	"contracts",
+	"contracts/sign",
+	// Invoice payment (reserved for the upcoming public pay flow)
+	"invoices",
+	"invoices/pay",
+	// Customer portal (logged-in customer-facing surface)
+	"portal",
+] as const;
+
+export type ReservedPagePath = (typeof RESERVED_PAGE_PATHS)[number];
+
+/**
+ * Normalize an input path/slug/pageKey to the canonical form used for
+ * reserved-path matching: lowercase, no surrounding slashes, no trailing
+ * `/index`.
+ */
+function normalize(input: string): string {
+	return input
+		.trim()
+		.toLowerCase()
+		.replace(/^\/+|\/+$/g, "")
+		.replace(/\/index$/, "");
+}
+
+/**
+ * True when `input` exactly matches a reserved path *or* is a child of
+ * one (`quotes/accept/foo` is reserved because it lives under `quotes`).
+ * Accepts page slugs, page keys, and full URL paths.
+ */
+export function isReservedPagePath(input: string): boolean {
+	const norm = normalize(input);
+	if (!norm) return false;
+	return RESERVED_PAGE_PATHS.some(
+		(reserved) => norm === reserved || norm.startsWith(`${reserved}/`),
+	);
+}
+
+/**
+ * Human-readable error message for use in CLI output and tRPC errors.
+ * Shared so the wording stays consistent across surfaces.
+ */
+export function reservedPagePathErrorMessage(input: string): string {
+	return [
+		`"${input}" is reserved by the BIAB platform.`,
+		`Reserved paths: ${RESERVED_PAGE_PATHS.join(", ")}.`,
+		`These routes are served on every verified org hostname for quote / contract / invoice flows;`,
+		`shipping a marketing page at the same path would break customer-facing accept / sign / pay links.`,
+		`Rename the page (e.g. "${input}-info") and try again.`,
+	].join(" ");
+}

package/src/revalidate-verify.ts

@@ -0,0 +1,98 @@
+/**
+ * Framework-agnostic HMAC verification for BIAB revalidation
+ * webhooks. Lives in its own file so adapters (Cloudflare, KV
+ * purge, static rebuild trigger, …) can pull it in without
+ * transitively bringing the Next-only `next-revalidate.ts` into
+ * the bundle graph. Some bundlers (Nitro, certain workerd
+ * targets) try to resolve every imported module name at build
+ * time, including ones reachable only through a runtime
+ * `await import(...)` — splitting `next/cache` into its own file
+ * keeps it isolated to the Next handler.
+ */
+
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+const REPLAY_WINDOW_SECONDS = 5 * 60;
+
+export interface BiabPublishPayload {
+	event: "content.published";
+	orgId: string;
+	tags: string[];
+	firedAt: string;
+}
+
+export interface VerifyOptions {
+	secret: string;
+	rawBody: string;
+	signatureHeader: string | null;
+	nowSeconds?: number;
+}
+
+export interface VerifyResult {
+	ok: boolean;
+	payload?: BiabPublishPayload;
+	reason?: string;
+}
+
+function safeEqualHex(a: string, b: string): boolean {
+	try {
+		const bufA = Buffer.from(a, "hex");
+		const bufB = Buffer.from(b, "hex");
+		if (bufA.length !== bufB.length) return false;
+		return timingSafeEqual(bufA, bufB);
+	} catch {
+		return false;
+	}
+}
+
+function parseSignatureHeader(
+	header: string | null,
+): { timestamp: number; v1: string } | null {
+	if (!header) return null;
+	const parts = header.split(",").map((p) => p.trim());
+	let timestamp = NaN;
+	let v1 = "";
+	for (const part of parts) {
+		const [k, v] = part.split("=", 2);
+		if (k === "t") timestamp = Number(v);
+		else if (k === "v1") v1 = v ?? "";
+	}
+	if (!Number.isFinite(timestamp) || !v1) return null;
+	return { timestamp, v1 };
+}
+
+export function verifyAndExtractTags(opts: VerifyOptions): VerifyResult {
+	const parsed = parseSignatureHeader(opts.signatureHeader);
+	if (!parsed) return { ok: false, reason: "missing_or_malformed_signature" };
+
+	const now =
+		typeof opts.nowSeconds === "number"
+			? opts.nowSeconds
+			: Math.floor(Date.now() / 1000);
+	if (Math.abs(now - parsed.timestamp) > REPLAY_WINDOW_SECONDS) {
+		return { ok: false, reason: "replay_window_expired" };
+	}
+
+	const signedPayload = `${parsed.timestamp}.${opts.rawBody}`;
+	const expected = createHmac("sha256", opts.secret)
+		.update(signedPayload)
+		.digest("hex");
+	if (!safeEqualHex(parsed.v1, expected)) {
+		return { ok: false, reason: "signature_mismatch" };
+	}
+
+	let payload: BiabPublishPayload;
+	try {
+		payload = JSON.parse(opts.rawBody) as BiabPublishPayload;
+	} catch {
+		return { ok: false, reason: "body_not_json" };
+	}
+	if (
+		payload?.event !== "content.published" ||
+		!Array.isArray(payload?.tags) ||
+		typeof payload?.orgId !== "string"
+	) {
+		return { ok: false, reason: "body_shape_invalid" };
+	}
+	return { ok: true, payload };
+}