@cmssy/core 11.5.0 → 11.6.0

package/dist/index.cjs

@@ -764,21 +764,24 @@ var CmssyWebhookError = class extends Error {
   }
 };
 var DEFAULT_TOLERANCE_SECONDS = 300;
+var MAX_SIGNATURES = 8;
 function parseSignatureHeader(header) {
   let timestamp = null;
-  let signature = null;
+  const signatures = [];
   for (const part of header.split(",")) {
     const idx = part.indexOf("=");
     if (idx === -1) continue;
     const key = part.slice(0, idx).trim();
     const value = part.slice(idx + 1).trim();
     if (key === "t") timestamp = Number(value);
-    else if (key === "v1") signature = value;
+    else if (key === "v1" && value && signatures.length < MAX_SIGNATURES) {
+      signatures.push(value);
+    }
   }
-  if (timestamp === null || !Number.isFinite(timestamp) || !signature) {
+  if (timestamp === null || !Number.isFinite(timestamp) || !signatures.length) {
     throw new CmssyWebhookError("Malformed X-Cmssy-Signature header");
   }
-  return { timestamp, signature };
+  return { timestamp, signatures };
 }
 function hexToBytes(hex) {
   if (hex.length % 2 !== 0 || /[^0-9a-fA-F]/.test(hex)) return null;
@@ -792,9 +795,10 @@ function bytesToHex(bytes) {
   return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 function timingSafeHexEqual(expectedHex, providedHex) {
+  if (expectedHex.length !== providedHex.length) return false;
   const expected = hexToBytes(expectedHex);
   const provided = hexToBytes(providedHex);
-  if (!expected || !provided || expected.length !== provided.length) {
+  if (!expected || !provided) {
     return false;
   }
   let diff = 0;
@@ -824,17 +828,28 @@ async function verifyCmssyWebhook(options) {
   if (!signatureHeader) {
     throw new CmssyWebhookError("Missing X-Cmssy-Signature header");
   }
-  if (!secret) {
+  const candidates = typeof secret === "string" ? [secret] : Array.isArray(secret) ? secret : [];
+  if (candidates.some((value) => typeof value !== "string")) {
+    throw new CmssyWebhookError("Webhook secret must be a string");
+  }
+  const secrets = candidates.filter(Boolean);
+  if (!secrets.length) {
     throw new CmssyWebhookError("Missing webhook secret");
   }
-  const { timestamp, signature } = parseSignatureHeader(signatureHeader);
+  const { timestamp, signatures } = parseSignatureHeader(signatureHeader);
   const toleranceMs = (options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS) * 1e3;
   const now = options.now ?? Date.now();
   if (Math.abs(now - timestamp) > toleranceMs) {
     throw new CmssyWebhookError("Webhook timestamp outside tolerance");
   }
-  const expected = await hmacSha256Hex(secret, `${timestamp}.${body}`);
-  if (!timingSafeHexEqual(expected, signature)) {
+  let matched = false;
+  for (const candidate of secrets) {
+    const expected = await hmacSha256Hex(candidate, `${timestamp}.${body}`);
+    for (const signature of signatures) {
+      if (timingSafeHexEqual(expected, signature)) matched = true;
+    }
+  }
+  if (!matched) {
     throw new CmssyWebhookError("Webhook signature mismatch");
   }
   let parsed;

package/dist/index.js

@@ -762,21 +762,24 @@ var CmssyWebhookError = class extends Error {
   }
 };
 var DEFAULT_TOLERANCE_SECONDS = 300;
+var MAX_SIGNATURES = 8;
 function parseSignatureHeader(header) {
   let timestamp = null;
-  let signature = null;
+  const signatures = [];
   for (const part of header.split(",")) {
     const idx = part.indexOf("=");
     if (idx === -1) continue;
     const key = part.slice(0, idx).trim();
     const value = part.slice(idx + 1).trim();
     if (key === "t") timestamp = Number(value);
-    else if (key === "v1") signature = value;
+    else if (key === "v1" && value && signatures.length < MAX_SIGNATURES) {
+      signatures.push(value);
+    }
   }
-  if (timestamp === null || !Number.isFinite(timestamp) || !signature) {
+  if (timestamp === null || !Number.isFinite(timestamp) || !signatures.length) {
     throw new CmssyWebhookError("Malformed X-Cmssy-Signature header");
   }
-  return { timestamp, signature };
+  return { timestamp, signatures };
 }
 function hexToBytes(hex) {
   if (hex.length % 2 !== 0 || /[^0-9a-fA-F]/.test(hex)) return null;
@@ -790,9 +793,10 @@ function bytesToHex(bytes) {
   return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 function timingSafeHexEqual(expectedHex, providedHex) {
+  if (expectedHex.length !== providedHex.length) return false;
   const expected = hexToBytes(expectedHex);
   const provided = hexToBytes(providedHex);
-  if (!expected || !provided || expected.length !== provided.length) {
+  if (!expected || !provided) {
     return false;
   }
   let diff = 0;
@@ -822,17 +826,28 @@ async function verifyCmssyWebhook(options) {
   if (!signatureHeader) {
     throw new CmssyWebhookError("Missing X-Cmssy-Signature header");
   }
-  if (!secret) {
+  const candidates = typeof secret === "string" ? [secret] : Array.isArray(secret) ? secret : [];
+  if (candidates.some((value) => typeof value !== "string")) {
+    throw new CmssyWebhookError("Webhook secret must be a string");
+  }
+  const secrets = candidates.filter(Boolean);
+  if (!secrets.length) {
     throw new CmssyWebhookError("Missing webhook secret");
   }
-  const { timestamp, signature } = parseSignatureHeader(signatureHeader);
+  const { timestamp, signatures } = parseSignatureHeader(signatureHeader);
   const toleranceMs = (options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS) * 1e3;
   const now = options.now ?? Date.now();
   if (Math.abs(now - timestamp) > toleranceMs) {
     throw new CmssyWebhookError("Webhook timestamp outside tolerance");
   }
-  const expected = await hmacSha256Hex(secret, `${timestamp}.${body}`);
-  if (!timingSafeHexEqual(expected, signature)) {
+  let matched = false;
+  for (const candidate of secrets) {
+    const expected = await hmacSha256Hex(candidate, `${timestamp}.${body}`);
+    for (const signature of signatures) {
+      if (timingSafeHexEqual(expected, signature)) matched = true;
+    }
+  }
+  if (!matched) {
     throw new CmssyWebhookError("Webhook signature mismatch");
   }
   let parsed;

package/dist/testing.cjs

@@ -141,39 +141,6 @@ async function graphqlRequest(config, query, variables, options = {}, label = "r
   });
 }
 
-// src/data/queries.ts
-var SITE_CONFIG_QUERY = `query PublicSiteConfig($workspaceSlug: String!) {
-  public {
-    siteConfig(workspaceSlug: $workspaceSlug) {
-      id
-      workspaceId
-      siteName
-      defaultLanguage
-      enabledLanguages
-      enabledFeatures
-      notFoundPageId
-      previewUrl
-      branding {
-        brandName
-        logoUrl
-        logoDarkUrl
-        faviconUrl
-        ogImageUrl
-      }
-    }
-  }
-}`;
-
-// src/data/site-locales.ts
-function localesFromSiteConfig(siteConfig) {
-  const defaultLocale = siteConfig?.defaultLanguage || "en";
-  const enabled = siteConfig?.enabledLanguages ?? [];
-  return {
-    defaultLocale,
-    locales: enabled.length > 0 ? enabled : [defaultLocale]
-  };
-}
-
 // src/preflight.ts
 var ALLOWED_FRAME_HOSTS = ["cmssy.io", "www.cmssy.io"];
 function frameAncestorSources(cspHeaderValue) {
@@ -269,29 +236,6 @@ async function workspaceHasLayoutBlocks(workspace, pageSlug) {
     return null;
   }
 }
-async function derivedLocalizedPath(workspace, path) {
-  try {
-    const data = await graphqlRequest(
-      workspace,
-      SITE_CONFIG_QUERY,
-      { workspaceSlug: workspace.workspaceSlug },
-      { public: true, retry: {} },
-      "edit smoke: site locales"
-    );
-    const { defaultLocale, locales } = localesFromSiteConfig(
-      data.public?.siteConfig ?? null
-    );
-    const locale = locales.find((candidate) => candidate !== defaultLocale);
-    if (!locale) return { kind: "none" };
-    const routed = withoutEditPrefix(path);
-    const [first] = routed.split("/").filter(Boolean);
-    if (first && locales.includes(first)) return { kind: "none" };
-    const suffix = routed === "/" || routed === "" ? "" : routed.replace(/\/+$/, "");
-    return { kind: "derived", locale, localizedPath: `/${locale}${suffix}` };
-  } catch {
-    return { kind: "unavailable" };
-  }
-}
 async function checkCmssyEditMode(options) {
   const { baseUrl, secret, path = "/" } = options;
   const failures = [];
@@ -345,20 +289,13 @@ async function checkCmssyEditMode(options) {
     }
   }
   const query = `cmssyEdit=1&cmssySecret=${encodeURIComponent(secret)}`;
-  const asked = options.localizedPath;
-  const derived = !asked && options.workspace ? await derivedLocalizedPath(options.workspace, path) : { kind: "none" };
-  if (derived.kind === "unavailable") {
-    failures.push(
-      `the delivery API would not say which languages ${options.workspace?.workspaceSlug} enables, so the preview's language went unchecked. That is the check three releases shipped a wrong-language preview past - a green run here does not mean it works.`
-    );
-  }
-  const localizedPath = asked ?? (derived.kind === "derived" ? derived.localizedPath : void 0);
+  const { localizedPath } = options;
   if (localizedPath) {
-    const locale = options.localizedLocale ?? (derived.kind === "derived" ? derived.locale : localeOf(localizedPath));
+    const locale = options.localizedLocale ?? localeOf(localizedPath);
     const localized = await html(url(`${localizedPath}?${query}`));
     if (localized.status !== 200) {
       failures.push(
-        derived.kind === "derived" ? `edit ${localizedPath}: expected 200, got ${localized.status}. The workspace enables "${locale}", so the language went unchecked - pass localizedPath if this site spells the language some other way.` : `edit ${localizedPath}: expected 200, got ${localized.status}`
+        `edit ${localizedPath}: expected 200, got ${localized.status}`
       );
     } else {
       if (!EDITOR_MARKER.test(localized.body)) {

package/dist/testing.d.cts

@@ -6,11 +6,13 @@ interface EditSmokeOptions {
     /** A published page to exercise. Defaults to "/". */
     path?: string;
     /**
-     * The same page under a language prefix, e.g. "/no". Pass it on a site whose
-     * URLs carry the language, and the check also proves the preview renders in
-     * THAT language rather than the default one - by reading `<html lang>`, which
-     * is a contract, unlike a word from the page's copy that an editor can change
-     * at any time.
+     * The same page under a language prefix, e.g. "/no". The caller states it
+     * because only the caller knows how its site spells a language; asking a
+     * workspace would tie this check to content that can change or be deleted.
+     *
+     * Given it, the check also proves the preview renders in THAT language rather
+     * than the default one - by reading `<html lang>`, which is a contract,
+     * unlike a word from the page's copy that an editor can change at any time.
      */
     localizedPath?: string;
     /**

package/dist/testing.d.ts

@@ -6,11 +6,13 @@ interface EditSmokeOptions {
     /** A published page to exercise. Defaults to "/". */
     path?: string;
     /**
-     * The same page under a language prefix, e.g. "/no". Pass it on a site whose
-     * URLs carry the language, and the check also proves the preview renders in
-     * THAT language rather than the default one - by reading `<html lang>`, which
-     * is a contract, unlike a word from the page's copy that an editor can change
-     * at any time.
+     * The same page under a language prefix, e.g. "/no". The caller states it
+     * because only the caller knows how its site spells a language; asking a
+     * workspace would tie this check to content that can change or be deleted.
+     *
+     * Given it, the check also proves the preview renders in THAT language rather
+     * than the default one - by reading `<html lang>`, which is a contract,
+     * unlike a word from the page's copy that an editor can change at any time.
      */
     localizedPath?: string;
     /**

package/dist/testing.js

@@ -139,39 +139,6 @@ async function graphqlRequest(config, query, variables, options = {}, label = "r
   });
 }
 
-// src/data/queries.ts
-var SITE_CONFIG_QUERY = `query PublicSiteConfig($workspaceSlug: String!) {
-  public {
-    siteConfig(workspaceSlug: $workspaceSlug) {
-      id
-      workspaceId
-      siteName
-      defaultLanguage
-      enabledLanguages
-      enabledFeatures
-      notFoundPageId
-      previewUrl
-      branding {
-        brandName
-        logoUrl
-        logoDarkUrl
-        faviconUrl
-        ogImageUrl
-      }
-    }
-  }
-}`;
-
-// src/data/site-locales.ts
-function localesFromSiteConfig(siteConfig) {
-  const defaultLocale = siteConfig?.defaultLanguage || "en";
-  const enabled = siteConfig?.enabledLanguages ?? [];
-  return {
-    defaultLocale,
-    locales: enabled.length > 0 ? enabled : [defaultLocale]
-  };
-}
-
 // src/preflight.ts
 var ALLOWED_FRAME_HOSTS = ["cmssy.io", "www.cmssy.io"];
 function frameAncestorSources(cspHeaderValue) {
@@ -267,29 +234,6 @@ async function workspaceHasLayoutBlocks(workspace, pageSlug) {
     return null;
   }
 }
-async function derivedLocalizedPath(workspace, path) {
-  try {
-    const data = await graphqlRequest(
-      workspace,
-      SITE_CONFIG_QUERY,
-      { workspaceSlug: workspace.workspaceSlug },
-      { public: true, retry: {} },
-      "edit smoke: site locales"
-    );
-    const { defaultLocale, locales } = localesFromSiteConfig(
-      data.public?.siteConfig ?? null
-    );
-    const locale = locales.find((candidate) => candidate !== defaultLocale);
-    if (!locale) return { kind: "none" };
-    const routed = withoutEditPrefix(path);
-    const [first] = routed.split("/").filter(Boolean);
-    if (first && locales.includes(first)) return { kind: "none" };
-    const suffix = routed === "/" || routed === "" ? "" : routed.replace(/\/+$/, "");
-    return { kind: "derived", locale, localizedPath: `/${locale}${suffix}` };
-  } catch {
-    return { kind: "unavailable" };
-  }
-}
 async function checkCmssyEditMode(options) {
   const { baseUrl, secret, path = "/" } = options;
   const failures = [];
@@ -343,20 +287,13 @@ async function checkCmssyEditMode(options) {
     }
   }
   const query = `cmssyEdit=1&cmssySecret=${encodeURIComponent(secret)}`;
-  const asked = options.localizedPath;
-  const derived = !asked && options.workspace ? await derivedLocalizedPath(options.workspace, path) : { kind: "none" };
-  if (derived.kind === "unavailable") {
-    failures.push(
-      `the delivery API would not say which languages ${options.workspace?.workspaceSlug} enables, so the preview's language went unchecked. That is the check three releases shipped a wrong-language preview past - a green run here does not mean it works.`
-    );
-  }
-  const localizedPath = asked ?? (derived.kind === "derived" ? derived.localizedPath : void 0);
+  const { localizedPath } = options;
   if (localizedPath) {
-    const locale = options.localizedLocale ?? (derived.kind === "derived" ? derived.locale : localeOf(localizedPath));
+    const locale = options.localizedLocale ?? localeOf(localizedPath);
     const localized = await html(url(`${localizedPath}?${query}`));
     if (localized.status !== 200) {
       failures.push(
-        derived.kind === "derived" ? `edit ${localizedPath}: expected 200, got ${localized.status}. The workspace enables "${locale}", so the language went unchecked - pass localizedPath if this site spells the language some other way.` : `edit ${localizedPath}: expected 200, got ${localized.status}`
+        `edit ${localizedPath}: expected 200, got ${localized.status}`
       );
     } else {
       if (!EDITOR_MARKER.test(localized.body)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/core",
-  "version": "11.5.0",
+  "version": "11.6.0",
   "description": "Framework-agnostic cmssy gateway: GraphQL client, block/field system, editor protocol. No React, no Next.",
   "keywords": [
     "cmssy",
@@ -62,7 +62,7 @@
     "vitest": "^2.1.0"
   },
   "dependencies": {
-    "@cmssy/types": "0.32.0",
+    "@cmssy/types": "0.33.0",
     "jose": "^6.2.3"
   },
   "scripts": {