@distilled.cloud/stripe 1.0.0-rc.13 → 1.0.0-rc.15

package/src/traits.ts

@@ -8,10 +8,7 @@
  * expansion), which core's `HttpTrait` doesn't model — the Stripe protocol
  * keys its body encoding on `contentType: "form-urlencoded"`.
  */
-import {
-  Http as CoreHttp,
-  type HttpTrait as CoreHttpTrait,
-} from "@distilled.cloud/core/trait";
+import { Http as CoreHttp, type HttpTrait as CoreHttpTrait } from "@distilled.cloud/core/trait";
 
 export {
   Body,

package/src/webhooks.ts

@@ -1,9 +1,6 @@
 import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
-import {
-  StripeWebhookPayloadParseError,
-  StripeWebhookSignatureError,
-} from "./errors.ts";
+import { StripeWebhookPayloadParseError, StripeWebhookSignatureError } from "./errors.ts";
 
 export const DEFAULT_WEBHOOK_TOLERANCE_SECONDS = 300;
 
@@ -69,8 +66,8 @@ const payloadToString = (payload: WebhookPayload): string => {
   return textDecoder.decode(payloadToBytes(payload));
 };
 
-const secretToString = (secret: WebhookSecret): string =>
-  Redacted.isRedacted(secret) ? (Redacted.value(secret) as string) : secret;
+const redactSecret = (secret: WebhookSecret): Redacted.Redacted<string> =>
+  Redacted.isRedacted(secret) ? secret : Redacted.make(secret);
 
 const parseSignatureHeader = (
   signature: string | null | undefined,
@@ -126,15 +123,10 @@ const parseSignatureHeader = (
   return { timestamp, timestampSeconds, signatures };
 };
 
-const signedPayloadBytes = (
-  timestamp: string,
-  payload: WebhookPayload,
-): ArrayBuffer => {
+const signedPayloadBytes = (timestamp: string, payload: WebhookPayload): ArrayBuffer => {
   const timestampBytes = textEncoder.encode(`${timestamp}.`);
   const bodyBytes = payloadToBytes(payload);
-  const signedPayload = new Uint8Array(
-    timestampBytes.byteLength + bodyBytes.byteLength,
-  );
+  const signedPayload = new Uint8Array(timestampBytes.byteLength + bodyBytes.byteLength);
 
   signedPayload.set(timestampBytes, 0);
   signedPayload.set(bodyBytes, timestampBytes.byteLength);
@@ -143,7 +135,7 @@ const signedPayloadBytes = (
 };
 
 const hmacSha256 = (
-  secret: string,
+  secret: Redacted.Redacted<string>,
   timestamp: string,
   payload: WebhookPayload,
 ): Effect.Effect<Uint8Array, StripeWebhookSignatureError> =>
@@ -151,7 +143,7 @@ const hmacSha256 = (
     try: async () => {
       const key = await crypto.subtle.importKey(
         "raw",
-        textEncoder.encode(secret),
+        textEncoder.encode(Redacted.value(secret)),
         { name: "HMAC", hash: "SHA-256" },
         false,
         ["sign"],
@@ -183,10 +175,7 @@ const hexToBytes = (hex: string): Uint8Array | undefined => {
   return bytes;
 };
 
-const constantTimeEqual = (
-  expected: Uint8Array,
-  candidate: Uint8Array,
-): boolean => {
+const constantTimeEqual = (expected: Uint8Array, candidate: Uint8Array): boolean => {
   // JavaScript cannot guarantee CPU-level constant time, but length mismatches
   // are folded into the accumulator so a matching prefix can never succeed.
   let difference = expected.byteLength ^ candidate.byteLength;
@@ -251,25 +240,17 @@ export const verifySignature = ({
       return yield* Effect.fail(parsed);
     }
 
-    const expectedSignature = yield* hmacSha256(
-      secretToString(secret),
-      parsed.timestamp,
-      payload,
-    );
+    const expectedSignature = yield* hmacSha256(redactSecret(secret), parsed.timestamp, payload);
 
     if (!hasMatchingSignature(expectedSignature, parsed.signatures)) {
       return yield* Effect.fail(
         new StripeWebhookSignatureError({
-          message:
-            "No v1 signature matches the expected Stripe webhook signature",
+          message: "No v1 signature matches the expected Stripe webhook signature",
         }),
       );
     }
 
-    const toleranceError = validateTolerance(
-      parsed.timestampSeconds,
-      toleranceSeconds,
-    );
+    const toleranceError = validateTolerance(parsed.timestampSeconds, toleranceSeconds);
     if (toleranceError !== undefined) {
       return yield* Effect.fail(toleranceError);
     }

package/lib/response-validation.test.d.ts

@@ -1,4 +0,0 @@
-import { StripeParseError } from "./errors.ts";
-import type { StripeOpError } from "./protocol.ts";
-export declare const parseErrorIsDeclared: [StripeParseError] extends [StripeOpError] ? true : false;
-//# sourceMappingURL=response-validation.test.d.ts.map

package/lib/response-validation.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"response-validation.test.d.ts","sourceRoot":"","sources":["../src/response-validation.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AA0CnD,eAAO,MAAM,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,aAAa,CAAC,GACzE,IAAI,GACJ,KAAY,CAAC"}

package/lib/response-validation.test.js

@@ -1,38 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { runValidationModes } from "@distilled.cloud/core/testing";
-import * as Effect from "effect/Effect";
-import { credentials } from "./credentials.js";
-import { StripeParseError } from "./errors.js";
-import * as Retry from "./retry.js";
-import { GetBalance } from "./services/stripe.js";
-// GetBalance declares `{ object; available; pending; livemode; … }`.
-const run = (body) => runValidationModes(GetBalance({}).pipe(Retry.none, Effect.provide(credentials({ apiKey: "sk_test_123" }))), { body });
-describe("Stripe response validation", () => {
-    test("a matching body succeeds unchanged in both modes", async () => {
-        const body = {
-            object: "balance",
-            available: [],
-            pending: [],
-            livemode: false,
-        };
-        const { lenient, strict } = await run(JSON.stringify(body));
-        expect(lenient).toMatchObject({ _tag: "Success", success: body });
-        expect(strict).toMatchObject({ _tag: "Success", success: body });
-    });
-    test("a body missing required members: lenient returns it, strict fails", async () => {
-        const body = {};
-        const { lenient, strict } = await run(JSON.stringify(body));
-        expect(lenient).toMatchObject({ _tag: "Success", success: body });
-        expect(strict._tag).toBe("Failure");
-        expect(strict.failure).toBeInstanceOf(StripeParseError);
-    });
-    test("a non-JSON body: lenient returns the text, strict fails", async () => {
-        const { lenient, strict } = await run("not json");
-        expect(lenient).toMatchObject({ _tag: "Success", success: "not json" });
-        expect(strict._tag).toBe("Failure");
-        expect(strict.failure).toBeInstanceOf(StripeParseError);
-    });
-});
-// StripeParseError is part of every operation's declared error type.
-export const parseErrorIsDeclared = true;
-//# sourceMappingURL=response-validation.test.js.map

package/lib/response-validation.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"response-validation.test.js","sourceRoot":"","sources":["../src/response-validation.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,qEAAqE;AACrE,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAC3B,kBAAkB,CAChB,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CACjB,KAAK,CAAC,IAAI,EACV,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,CACvD,EACD,EAAE,IAAI,EAAE,CACT,CAAC;AAEJ,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,IAAI,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,IAAI,GAAG,EAAE,CAAC;QAChB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAE,MAAc,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAE,MAAc,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,oBAAoB,GAErB,IAAI,CAAC"}

package/src/response-validation.test.ts

@@ -1,52 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { runValidationModes } from "@distilled.cloud/core/testing";
-import * as Effect from "effect/Effect";
-import { credentials } from "./credentials.ts";
-import { StripeParseError } from "./errors.ts";
-import * as Retry from "./retry.ts";
-import { GetBalance } from "./services/stripe.ts";
-import type { StripeOpError } from "./protocol.ts";
-
-// GetBalance declares `{ object; available; pending; livemode; … }`.
-const run = (body: string) =>
-  runValidationModes(
-    GetBalance({}).pipe(
-      Retry.none,
-      Effect.provide(credentials({ apiKey: "sk_test_123" })),
-    ),
-    { body },
-  );
-
-describe("Stripe response validation", () => {
-  test("a matching body succeeds unchanged in both modes", async () => {
-    const body = {
-      object: "balance",
-      available: [],
-      pending: [],
-      livemode: false,
-    };
-    const { lenient, strict } = await run(JSON.stringify(body));
-    expect(lenient).toMatchObject({ _tag: "Success", success: body });
-    expect(strict).toMatchObject({ _tag: "Success", success: body });
-  });
-
-  test("a body missing required members: lenient returns it, strict fails", async () => {
-    const body = {};
-    const { lenient, strict } = await run(JSON.stringify(body));
-    expect(lenient).toMatchObject({ _tag: "Success", success: body });
-    expect(strict._tag).toBe("Failure");
-    expect((strict as any).failure).toBeInstanceOf(StripeParseError);
-  });
-
-  test("a non-JSON body: lenient returns the text, strict fails", async () => {
-    const { lenient, strict } = await run("not json");
-    expect(lenient).toMatchObject({ _tag: "Success", success: "not json" });
-    expect(strict._tag).toBe("Failure");
-    expect((strict as any).failure).toBeInstanceOf(StripeParseError);
-  });
-});
-
-// StripeParseError is part of every operation's declared error type.
-export const parseErrorIsDeclared: [StripeParseError] extends [StripeOpError]
-  ? true
-  : false = true;