@cmssy/core 11.5.1 → 11.6.0

package/dist/index.cjs

@@ -764,21 +764,24 @@ var CmssyWebhookError = class extends Error {
   }
 };
 var DEFAULT_TOLERANCE_SECONDS = 300;
+var MAX_SIGNATURES = 8;
 function parseSignatureHeader(header) {
   let timestamp = null;
-  let signature = null;
+  const signatures = [];
   for (const part of header.split(",")) {
     const idx = part.indexOf("=");
     if (idx === -1) continue;
     const key = part.slice(0, idx).trim();
     const value = part.slice(idx + 1).trim();
     if (key === "t") timestamp = Number(value);
-    else if (key === "v1") signature = value;
+    else if (key === "v1" && value && signatures.length < MAX_SIGNATURES) {
+      signatures.push(value);
+    }
   }
-  if (timestamp === null || !Number.isFinite(timestamp) || !signature) {
+  if (timestamp === null || !Number.isFinite(timestamp) || !signatures.length) {
     throw new CmssyWebhookError("Malformed X-Cmssy-Signature header");
   }
-  return { timestamp, signature };
+  return { timestamp, signatures };
 }
 function hexToBytes(hex) {
   if (hex.length % 2 !== 0 || /[^0-9a-fA-F]/.test(hex)) return null;
@@ -792,9 +795,10 @@ function bytesToHex(bytes) {
   return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 function timingSafeHexEqual(expectedHex, providedHex) {
+  if (expectedHex.length !== providedHex.length) return false;
   const expected = hexToBytes(expectedHex);
   const provided = hexToBytes(providedHex);
-  if (!expected || !provided || expected.length !== provided.length) {
+  if (!expected || !provided) {
     return false;
   }
   let diff = 0;
@@ -824,17 +828,28 @@ async function verifyCmssyWebhook(options) {
   if (!signatureHeader) {
     throw new CmssyWebhookError("Missing X-Cmssy-Signature header");
   }
-  if (!secret) {
+  const candidates = typeof secret === "string" ? [secret] : Array.isArray(secret) ? secret : [];
+  if (candidates.some((value) => typeof value !== "string")) {
+    throw new CmssyWebhookError("Webhook secret must be a string");
+  }
+  const secrets = candidates.filter(Boolean);
+  if (!secrets.length) {
     throw new CmssyWebhookError("Missing webhook secret");
   }
-  const { timestamp, signature } = parseSignatureHeader(signatureHeader);
+  const { timestamp, signatures } = parseSignatureHeader(signatureHeader);
   const toleranceMs = (options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS) * 1e3;
   const now = options.now ?? Date.now();
   if (Math.abs(now - timestamp) > toleranceMs) {
     throw new CmssyWebhookError("Webhook timestamp outside tolerance");
   }
-  const expected = await hmacSha256Hex(secret, `${timestamp}.${body}`);
-  if (!timingSafeHexEqual(expected, signature)) {
+  let matched = false;
+  for (const candidate of secrets) {
+    const expected = await hmacSha256Hex(candidate, `${timestamp}.${body}`);
+    for (const signature of signatures) {
+      if (timingSafeHexEqual(expected, signature)) matched = true;
+    }
+  }
+  if (!matched) {
     throw new CmssyWebhookError("Webhook signature mismatch");
   }
   let parsed;

package/dist/index.js

@@ -762,21 +762,24 @@ var CmssyWebhookError = class extends Error {
   }
 };
 var DEFAULT_TOLERANCE_SECONDS = 300;
+var MAX_SIGNATURES = 8;
 function parseSignatureHeader(header) {
   let timestamp = null;
-  let signature = null;
+  const signatures = [];
   for (const part of header.split(",")) {
     const idx = part.indexOf("=");
     if (idx === -1) continue;
     const key = part.slice(0, idx).trim();
     const value = part.slice(idx + 1).trim();
     if (key === "t") timestamp = Number(value);
-    else if (key === "v1") signature = value;
+    else if (key === "v1" && value && signatures.length < MAX_SIGNATURES) {
+      signatures.push(value);
+    }
   }
-  if (timestamp === null || !Number.isFinite(timestamp) || !signature) {
+  if (timestamp === null || !Number.isFinite(timestamp) || !signatures.length) {
     throw new CmssyWebhookError("Malformed X-Cmssy-Signature header");
   }
-  return { timestamp, signature };
+  return { timestamp, signatures };
 }
 function hexToBytes(hex) {
   if (hex.length % 2 !== 0 || /[^0-9a-fA-F]/.test(hex)) return null;
@@ -790,9 +793,10 @@ function bytesToHex(bytes) {
   return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 function timingSafeHexEqual(expectedHex, providedHex) {
+  if (expectedHex.length !== providedHex.length) return false;
   const expected = hexToBytes(expectedHex);
   const provided = hexToBytes(providedHex);
-  if (!expected || !provided || expected.length !== provided.length) {
+  if (!expected || !provided) {
     return false;
   }
   let diff = 0;
@@ -822,17 +826,28 @@ async function verifyCmssyWebhook(options) {
   if (!signatureHeader) {
     throw new CmssyWebhookError("Missing X-Cmssy-Signature header");
   }
-  if (!secret) {
+  const candidates = typeof secret === "string" ? [secret] : Array.isArray(secret) ? secret : [];
+  if (candidates.some((value) => typeof value !== "string")) {
+    throw new CmssyWebhookError("Webhook secret must be a string");
+  }
+  const secrets = candidates.filter(Boolean);
+  if (!secrets.length) {
     throw new CmssyWebhookError("Missing webhook secret");
   }
-  const { timestamp, signature } = parseSignatureHeader(signatureHeader);
+  const { timestamp, signatures } = parseSignatureHeader(signatureHeader);
   const toleranceMs = (options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS) * 1e3;
   const now = options.now ?? Date.now();
   if (Math.abs(now - timestamp) > toleranceMs) {
     throw new CmssyWebhookError("Webhook timestamp outside tolerance");
   }
-  const expected = await hmacSha256Hex(secret, `${timestamp}.${body}`);
-  if (!timingSafeHexEqual(expected, signature)) {
+  let matched = false;
+  for (const candidate of secrets) {
+    const expected = await hmacSha256Hex(candidate, `${timestamp}.${body}`);
+    for (const signature of signatures) {
+      if (timingSafeHexEqual(expected, signature)) matched = true;
+    }
+  }
+  if (!matched) {
     throw new CmssyWebhookError("Webhook signature mismatch");
   }
   let parsed;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/core",
-  "version": "11.5.1",
+  "version": "11.6.0",
   "description": "Framework-agnostic cmssy gateway: GraphQL client, block/field system, editor protocol. No React, no Next.",
   "keywords": [
     "cmssy",
@@ -62,7 +62,7 @@
     "vitest": "^2.1.0"
   },
   "dependencies": {
-    "@cmssy/types": "0.32.0",
+    "@cmssy/types": "0.33.0",
     "jose": "^6.2.3"
   },
   "scripts": {