@drawbridge/drawbridge-utils 0.0.156 → 0.0.158

package/dist/connections/index.js

@@ -855,7 +855,53 @@ var attentive_default2 = {
 };
 
 // lib/connections/providers/drawbridge.js
-import { createHmac, timingSafeEqual } from "crypto";
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+
+// lib/connections/inbound.js
+import { createHmac, createVerify, timingSafeEqual } from "crypto";
+var verifySignature = ({ body, descriptor, headers, secret }) => {
+  if (!secret) {
+    throw Object.assign(new Error("Missing webhook secret: " + descriptor.signature.secret), { status: 500 });
+  }
+  const provided = headers[descriptor.headers.signature];
+  if (!provided) {
+    throw Object.assign(new Error("Missing webhook signature"), { status: 401 });
+  }
+  const digest = createHmac(descriptor.signature.algorithm, secret).update(body).digest(descriptor.signature.encoding);
+  const digestBuffer = Buffer.from(digest, descriptor.signature.encoding);
+  const providedBuffer = Buffer.from(provided, descriptor.signature.encoding);
+  if (digestBuffer.length !== providedBuffer.length || !timingSafeEqual(digestBuffer, providedBuffer)) {
+    throw Object.assign(new Error("Invalid webhook signature"), { status: 401 });
+  }
+  return JSON.parse(body.toString());
+};
+var REPLAY_TOLERANCE_SECONDS = 5 * 60;
+var asPem = (key) => [
+  "-----BEGIN PUBLIC KEY-----",
+  ...key.match(/.{1,64}/g) || [],
+  "-----END PUBLIC KEY-----"
+].join("\n");
+var verifyEcdsa = ({ body, descriptor, headers, secret }) => {
+  if (!secret) {
+    throw Object.assign(new Error("Missing webhook key: " + descriptor.signature.secret), { status: 500 });
+  }
+  const provided = headers[descriptor.headers.signature];
+  const timestamp = headers[descriptor.headers.timestamp];
+  if (!provided || !timestamp) {
+    throw Object.assign(new Error("Missing webhook signature"), { status: 401 });
+  }
+  const age = Math.abs(Math.floor(Date.now() / 1e3) - Number(timestamp));
+  if (!(age <= REPLAY_TOLERANCE_SECONDS)) {
+    throw Object.assign(new Error("Stale webhook signature"), { status: 401 });
+  }
+  const payload = Buffer.concat([Buffer.from(String(timestamp), "utf8"), body]);
+  const verified = createVerify("sha256").update(payload).verify(asPem(secret), Buffer.from(provided, "base64"));
+  if (!verified) {
+    throw Object.assign(new Error("Invalid webhook signature"), { status: 401 });
+  }
+  return JSON.parse(body.toString());
+};
+var readEventHeader = ({ descriptor, headers }) => headers[descriptor.headers.event];
 
 // lib/http.js
 var DEFAULT_TIMEOUT_MS = 15e3;
@@ -1746,6 +1792,144 @@ var MINIMUM_ACTION_CENTS = Math.round(
 // lib/connections/providers/drawbridge.js
 var STOP_KEYWORDS = ["STOP", "STOPALL", "UNSUBSCRIBE", "CANCEL", "END", "QUIT"];
 var START_KEYWORDS = ["START", "UNSTOP", "YES"];
+var sendgridInbound = {
+  headers: {
+    signature: "x-twilio-email-event-webhook-signature",
+    timestamp: "x-twilio-email-event-webhook-timestamp"
+  },
+  signature: {
+    secret: "SENDGRID_EVENT_WEBHOOK_KEY"
+  }
+};
+var REFUSALS = /* @__PURE__ */ new Set(["blocked", "bounce", "deferred", "dropped", "spamreport"]);
+var DELIVERY = {
+  queued: 10,
+  sent: 20,
+  deferred: 30,
+  blocked: 40,
+  delivered: 50,
+  bounced: 60,
+  complained: 70
+};
+var fromSendgrid = (event) => {
+  if ((event == null ? void 0 : event.event) === "bounce") return event.type === "blocked" ? "blocked" : "bounced";
+  return {
+    blocked: "blocked",
+    deferred: "deferred",
+    delivered: "delivered",
+    dropped: "bounced",
+    processed: "queued",
+    spamreport: "complained"
+  }[event == null ? void 0 : event.event] || null;
+};
+var fromTwilio = (status) => ({
+  delivered: "delivered",
+  failed: "bounced",
+  queued: "queued",
+  sending: "sent",
+  sent: "sent",
+  undelivered: "bounced"
+})[String(status || "").toLowerCase()] || null;
+var deliveryWrite = ({ at, code: code2, notification, permanent, provider, reason, status }) => {
+  const rank = DELIVERY[status];
+  if (!notification || !rank) return null;
+  return {
+    collection: "notification",
+    data: {
+      $set: {
+        "meta.delivery": {
+          at: at || /* @__PURE__ */ new Date(),
+          ...code2 !== void 0 && code2 !== null && { code: String(code2) },
+          ...permanent !== void 0 && { permanent },
+          provider,
+          rank,
+          ...reason && { reason: String(reason) },
+          status
+        }
+      }
+    },
+    operation: "update",
+    query: {
+      id: notification,
+      // NEVER an upsert. A callback naming a notification we do not have is a
+      // vendor talking about someone else's message, not a document to create.
+      $or: [
+        { "meta.delivery.rank": { $exists: false } },
+        { "meta.delivery.rank": { $lt: rank } }
+      ]
+    }
+  };
+};
+var summariseEvents = (events) => {
+  const list = Array.isArray(events) ? events : [];
+  if (!list.length) return { message: "SendGrid delivered an empty event batch.", skipped: true };
+  const counts = {};
+  for (const { event } of list) {
+    const name = event || "unknown";
+    counts[name] = (counts[name] || 0) + 1;
+  }
+  const tally = Object.entries(counts).map(([name, count]) => count + " " + name).join(", ");
+  const refused = list.filter(({ event }) => REFUSALS.has(event)).slice(0, 5).map(({ email, reason, response, status }) => email + " \u2014 " + (reason || response || status || "no reason given"));
+  const writes = list.map((event) => {
+    var _a;
+    return deliveryWrite({
+      at: event.timestamp ? new Date(event.timestamp * 1e3) : void 0,
+      code: event.status,
+      // Read BOTH shapes. SendGrid echoes custom_args as siblings of `email`
+      // and `event`, which is why it warns about colliding with reserved
+      // names — but this is the one thing in the design that cannot be proved
+      // until a real event arrives, and reading the nested form too costs a
+      // token and removes the only silent failure left here.
+      notification: event.notification || ((_a = event.custom_args) == null ? void 0 : _a.notification),
+      // Only a bounce carries the distinction, and only a real one is
+      // permanent — `blocked` is this attempt refused, not this address dead.
+      ...event.event === "bounce" && { permanent: event.type !== "blocked" },
+      provider: { slug: "sendgrid", id: event.sg_message_id || null },
+      reason: event.reason || event.response,
+      status: fromSendgrid(event)
+    });
+  }).filter(Boolean);
+  return {
+    message: [list.length + " SendGrid event(s): " + tally, ...refused].join(" | "),
+    ...writes.length ? { writes } : { skipped: true }
+  };
+};
+var statusCallback = (data2) => {
+  const status = fromTwilio((data2 == null ? void 0 : data2.MessageStatus) || (data2 == null ? void 0 : data2.SmsStatus));
+  if (!status) return { message: "Twilio sent a status this does not map: " + ((data2 == null ? void 0 : data2.MessageStatus) || "none"), skipped: true };
+  const rank = DELIVERY[status];
+  const write = {
+    collection: "notification",
+    data: {
+      $set: {
+        "meta.delivery": {
+          at: /* @__PURE__ */ new Date(),
+          ...(data2 == null ? void 0 : data2.ErrorCode) && { code: String(data2.ErrorCode) },
+          // `failed` never left Twilio and `undelivered` was refused by the
+          // carrier. Both are dead ends for this handset, so neither is
+          // reported as a temporary condition.
+          ...status === "bounced" && { permanent: true },
+          provider: { slug: "twilio", id: (data2 == null ? void 0 : data2.MessageSid) || null },
+          rank,
+          ...(data2 == null ? void 0 : data2.ErrorMessage) && { reason: String(data2.ErrorMessage) },
+          status
+        }
+      }
+    },
+    operation: "update",
+    query: {
+      "meta.delivery.provider.id": data2 == null ? void 0 : data2.MessageSid,
+      $or: [
+        { "meta.delivery.rank": { $exists: false } },
+        { "meta.delivery.rank": { $lt: rank } }
+      ]
+    }
+  };
+  return {
+    message: "Twilio " + status + " for " + ((data2 == null ? void 0 : data2.MessageSid) || "an unnamed message") + ((data2 == null ? void 0 : data2.ErrorCode) ? " (" + data2.ErrorCode + ")" : ""),
+    ...(data2 == null ? void 0 : data2.MessageSid) ? { writes: [write] } : { skipped: true }
+  };
+};
 var interpolate = (template, data2) => {
   if (!template) return template;
   return template.replace(/\{\{(\w+)\}\}/g, (_, key) => (data2 == null ? void 0 : data2[key]) != null ? String(data2[key]) : "{{" + key + "}}");
@@ -1989,9 +2173,16 @@ var drawbridge_default2 = {
     // other vendor, and the bespoke webhooks route + the handler that lived in
     // sync's buffer table are gone.
     inbound: {
-      // EVERY POST ON THIS CHANNEL IS AN INBOUND MESSAGE. Twilio sends no
-      // topic header — the registered url IS the topic.
-      event: () => "message.inbound",
+      // THE REGISTERED URL IS THE TOPIC. Neither vendor sends a topic header,
+      // so the channel it arrived on names the event — `sms` is one inbound
+      // message, `email` is a batch of SendGrid delivery events.
+      //
+      // Defaulted because the drain calls `event()` with nothing when it only
+      // wants the SMS name.
+      event: ({ channel } = {}) => ({
+        email: "email.events",
+        "sms-status": "sms.status"
+      })[channel] || "message.inbound",
       // STOP AND START, AS DESCRIBED WRITES. A withdrawn number is withdrawn
       // for everyone — organization : null is the platform floor canSend()
       // reads on every send path. $setOnInsert + upsert so webhook replays
@@ -1999,6 +2190,8 @@ var drawbridge_default2 = {
       // organization } index instead of erroring.
       process: ({ context }) => {
         var _a, _b;
+        if ((context == null ? void 0 : context.topic) === "email.events") return summariseEvents(context == null ? void 0 : context.data);
+        if ((context == null ? void 0 : context.topic) === "sms.status") return statusCallback(context == null ? void 0 : context.data);
         const keyword = String(((_a = context == null ? void 0 : context.data) == null ? void 0 : _a.Body) || "").trim().toUpperCase();
         const address = toE164((_b = context == null ? void 0 : context.data) == null ? void 0 : _b.From);
         if (!address) return { message: "Inbound SMS carried no usable sender number.", skipped: true };
@@ -2044,9 +2237,14 @@ var drawbridge_default2 = {
         }
         return { message: "A real reply, not a keyword \u2014 nothing to record.", skipped: true };
       },
-      receive: ({ payload }) => ({
+      // A SendGrid batch carries many sg_message_ids and no single identity, so
+      // it names no provider id. That means no dedupe key for a redelivery —
+      // acceptable because SendGrid only retries a non-2xx, and the cost of a
+      // duplicate here is a second buffer row rather than a repeated side
+      // effect. Revisit if this ever writes suppressions.
+      receive: ({ channel, payload }) => ({
         data: payload,
-        provider: { id: (payload == null ? void 0 : payload.MessageSid) || null }
+        provider: { id: channel === "email" ? null : (payload == null ? void 0 : payload.MessageSid) || null }
       }),
       // TWILIO'S SCHEME, from docs.twilio.com/usage/security: take the full
       // registered url, sort the POST parameters alphabetically (Unix-style,
@@ -2055,13 +2253,14 @@ var drawbridge_default2 = {
       // X-Twilio-Signature. It signs the URL rather than the raw body, which
       // is exactly why the shared body-HMAC verifier cannot cover it and this
       // hook exists.
-      verify: ({ body, headers, secret, url }) => {
+      verify: ({ body, channel, headers, secret, url }) => {
+        if (channel === "email") return verifyEcdsa({ body, descriptor: sendgridInbound, headers, secret });
         if (!secret) throw Object.assign(new Error("Missing webhook secret: TWILIO_AUTH_TOKEN"), { status: 500 });
         const params = new URLSearchParams(String(body || ""));
         const signed = url + [...params.keys()].sort().map((key) => key + params.get(key)).join("");
-        const expected = createHmac("sha1", secret).update(signed).digest("base64");
+        const expected = createHmac2("sha1", secret).update(signed).digest("base64");
         const provided = String((headers == null ? void 0 : headers["x-twilio-signature"]) || "");
-        const matches = expected.length === provided.length && timingSafeEqual(Buffer.from(expected), Buffer.from(provided));
+        const matches = expected.length === provided.length && timingSafeEqual2(Buffer.from(expected), Buffer.from(provided));
         if (!matches) throw Object.assign(new Error("Invalid Twilio signature"), { status: 401 });
         return Object.fromEntries(params);
       }
@@ -2245,15 +2444,30 @@ var drawbridge_default2 = {
   },
   icon: drawbridge_default,
   // WHERE TWILIO PUTS THINGS on an inbound request, and WHICH credential
-  // verifies it. `secret` names the drawbridge provider's smsToken — the route
-  // resolves the name to the stored value and hands it to verify.
+  // verifies each channel. The route resolves the NAME to the stored value and
+  // hands it to verify; this manifest never reads a store.
+  //
+  // `signature.channels` because this is the one manifest that receives from two
+  // different vendors — Twilio on `sms`, SendGrid on `email` — which need
+  // different credentials and share no scheme. A manifest whose channels all
+  // verify the same way keeps declaring `signature` flat, and the route falls
+  // back to it; Shopify's two channels do exactly that.
   inbound: {
     headers: {
       id: "i-twilio-idempotency-token",
       signature: "x-twilio-signature"
     },
     signature: {
-      secret: "TWILIO_AUTH_TOKEN"
+      channels: {
+        email: sendgridInbound.signature,
+        sms: { secret: "TWILIO_AUTH_TOKEN" },
+        // Outbound delivery receipts, which Twilio signs exactly as it signs
+        // an inbound message — same scheme, same credential, different url.
+        // Separate channel because the payload is a MessageStatus rather than
+        // a message, and conflating them would put a STOP keyword check on a
+        // delivery receipt.
+        "sms-status": { secret: "TWILIO_AUTH_TOKEN" }
+      }
     }
   },
   // PRIVATE: never in the catalog, always available to the builder.
@@ -2285,6 +2499,13 @@ var drawbridge_default2 = {
           // Optional: SENDGRID_SEND_FROM_ADDRESS is not boot-required in sync
           // either. Unset, it degrades to the account sender rather than
           // refusing to start.
+          // NOT redacted, because it is a PUBLIC key. Marking it secret would
+          // be theatre, and it would stop an operator reading back the value
+          // they need to compare against the SendGrid console.
+          //
+          // Optional: absent, the event webhook answers 500 on verify rather
+          // than accepting unverified deliveries, and nothing else notices.
+          { input: "text", key: "eventKey", credential: "SENDGRID_EVENT_WEBHOOK_KEY", label: "Event webhook key", message: "SendGrid, Settings, Mail Settings, Event Webhook \u2014 the verification key shown once signature verification is enabled. Public, not a secret." },
           { input: "email", key: "leadSender", credential: "SENDGRID_SEND_FROM_ADDRESS", label: "Lead sender", message: "The default for lead-facing mail when a merchant has not verified their own domain." }
         ],
         icon: sendgrid_default,
@@ -3399,26 +3620,6 @@ var shopify_default = `<svg width="500" height="500" viewBox="0 0 500 500" fill=
 <path d="M300.325 382.771L368 365.96C368 365.96 338.904 169.185 338.689 167.892C338.473 166.599 337.396 165.737 336.318 165.737C335.24 165.737 316.274 165.306 316.274 165.306C316.274 165.306 304.636 154.099 300.325 149.788V382.771Z" fill="white"/>
 </svg>`;
 
-// lib/connections/inbound.js
-import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var verifySignature = ({ body, descriptor, headers, secret }) => {
-  if (!secret) {
-    throw Object.assign(new Error("Missing webhook secret: " + descriptor.signature.secret), { status: 500 });
-  }
-  const provided = headers[descriptor.headers.signature];
-  if (!provided) {
-    throw Object.assign(new Error("Missing webhook signature"), { status: 401 });
-  }
-  const digest = createHmac2(descriptor.signature.algorithm, secret).update(body).digest(descriptor.signature.encoding);
-  const digestBuffer = Buffer.from(digest, descriptor.signature.encoding);
-  const providedBuffer = Buffer.from(provided, descriptor.signature.encoding);
-  if (digestBuffer.length !== providedBuffer.length || !timingSafeEqual2(digestBuffer, providedBuffer)) {
-    throw Object.assign(new Error("Invalid webhook signature"), { status: 401 });
-  }
-  return JSON.parse(body.toString());
-};
-var readEventHeader = ({ descriptor, headers }) => headers[descriptor.headers.event];
-
 // lib/email.js
 var GMAIL_DOMAINS = /* @__PURE__ */ new Set(["gmail.com", "googlemail.com"]);
 var toCanonicalEmail = (value) => {
@@ -4791,9 +4992,14 @@ var isBlockedIPv4 = (ip) => {
   if (a >= 224) return true;
   return false;
 };
+var transition = new net.BlockList();
+transition.addSubnet("64:ff9b::", 96, "ipv6");
+transition.addSubnet("2002::", 16, "ipv6");
+transition.addSubnet("2001::", 32, "ipv6");
 var isBlockedIPv6 = (ip) => {
   const lower = ip.toLowerCase();
   if (lower === "::1" || lower === "::") return true;
+  if (transition.check(ip, "ipv6")) return true;
   if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
   if (/^fe[89ab]/.test(lower)) return true;
   if (lower.startsWith("ff")) return true;
@@ -4852,12 +5058,13 @@ var pinnedAgent = async (url) => {
 var safeRequest = async ({
   body,
   headers = {},
+  maxContentLength,
   method = "GET",
   query,
   timeout = DEFAULT_TIMEOUT_MS2,
   type = "json",
   url
-}) => {
+}, { transport = axios } = {}) => {
   const full = new URL(url);
   if (query) {
     Object.entries(query).forEach(([key, value]) => full.searchParams.set(key, value));
@@ -4865,7 +5072,7 @@ var safeRequest = async ({
   const { protocol, agent } = await pinnedAgent(full.toString());
   const isForm = type === "form";
   try {
-    const response = await axios({
+    const response = await transport({
       method,
       url: full.toString(),
       headers: {
@@ -4875,6 +5082,7 @@ var safeRequest = async ({
       ...body !== void 0 && {
         data: isForm ? new URLSearchParams(body).toString() : body
       },
+      ...maxContentLength !== void 0 && { maxContentLength },
       timeout,
       maxRedirects: 0,
       httpAgent: protocol === "http:" ? agent : void 0,
@@ -4897,6 +5105,19 @@ var safeRequest = async ({
 };
 
 // lib/connections/providers/webhook.js
+var RESPONSE_LIMIT = 64 * 1024;
+var signature = ({ body, settings }) => {
+  var _a;
+  const timestamp = Math.floor(Date.now() / 1e3);
+  const payload = timestamp + "." + JSON.stringify(body);
+  const previous = ((_a = settings.previous) == null ? void 0 : _a.secret) && new Date(settings.previous.until) > /* @__PURE__ */ new Date() ? [settings.previous.secret] : [];
+  return [
+    "t=" + timestamp,
+    ...[settings.secret, ...previous].map(
+      (secret) => "v1=" + crypto2.createHmac("sha256", secret).update(payload).digest("hex")
+    )
+  ].join(",");
+};
 var webhook_default = {
   // Connecting GENERATES the secret rather than storing one the merchant typed,
   // so the buttons say what actually happens.
@@ -4927,7 +5148,9 @@ var webhook_default = {
       "Press Connect. Drawbridge generates a signing secret and shows it here.",
       "Copy the secret into your own endpoint.",
       "Add a Send webhook step to a workflow and put your endpoint URL on it. The URL belongs to the step rather than the connection, so one connection can serve several endpoints.",
-      "On each request, compute HMAC-SHA256 of the raw body using the secret and compare it against the X-Drawbridge-Signature header before acting on the payload."
+      "On each request, read the X-Drawbridge-Signature header \u2014 `t=<unix seconds>,v1=<hex>` \u2014 and compute HMAC-SHA256 of `<t>.<raw request body>` with the secret. Use the raw bytes, not a re-serialised parse.",
+      "Compare your result against each v1 value with a constant-time comparison, and reject any request whose timestamp is more than five minutes old.",
+      "After you regenerate the secret, the previous one keeps signing for 24 hours (as a second v1), so update your endpoint within that window."
     ]
   },
   // Nothing to be exclusive with — there is no second webhook vendor, and a
@@ -4995,13 +5218,14 @@ var webhook_default = {
         const { headers = {}, method = "POST", url } = step.settings || {};
         const request2 = { method, url: url || null };
         if (!url) return { message: "Outgoing webhook URL is not configured for this step.", request: request2, response: { skipped: true }, skipped: true };
+        if (!/^https:\/\//i.test(url)) return { message: "Outgoing webhook URL must use https.", request: request2, response: { skipped: true }, skipped: true };
         const body = lead || context;
         request2.body = body;
         const outgoing = { ...headers };
         if (settings == null ? void 0 : settings.secret) {
-          outgoing["X-Drawbridge-Signature"] = "sha256=" + crypto2.createHmac("sha256", settings.secret).update(JSON.stringify(body)).digest("hex");
+          outgoing["X-Drawbridge-Signature"] = signature({ body, settings });
         }
-        const response = await send2({ body, headers: outgoing, method, url });
+        const response = await send2({ body, headers: outgoing, maxContentLength: RESPONSE_LIMIT, method, url });
         return { message: "Webhook POSTed to " + url + ".", request: request2, response: response || { delivered: true } };
       }
     }
@@ -5050,7 +5274,7 @@ var webhook_default = {
   // and a task repeating it talks over the button.
   tasks: ({ settings, status } = {}) => ["disconnected", "error"].includes(status) ? [] : (settings == null ? void 0 : settings.secret) ? [
     {
-      message: "Compute HMAC-SHA256( secret, body ) and compare against the X-Drawbridge-Signature header to confirm each payload.",
+      message: 'Compute HMAC-SHA256( secret, t + "." + raw body ) and constant-time compare it against a v1 in the X-Drawbridge-Signature header; reject timestamps older than five minutes.',
       title: "Requests must be verified",
       type: "warning"
     }