@fungi.computer/veil 0.0.1 → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/event-verifiers.js
CHANGED
|
@@ -21,15 +21,15 @@ const eventIds = defineIdFamily({
|
|
|
21
21
|
version: 1,
|
|
22
22
|
kinds: { delivery: { prefix: "event_delivery" } },
|
|
23
23
|
});
|
|
24
|
-
const secretSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/u);
|
|
25
|
-
const fungiSignatureSchema = z.string().regex(/^v1=[a-f0-9]{64}$/u);
|
|
26
|
-
const githubSignatureSchema = z.string().regex(/^sha256=[a-f0-9]{64}$/u);
|
|
27
|
-
const githubDeliverySchema = z.string().regex(/^[A-Za-z0-9._-]{1,128}$/u);
|
|
28
|
-
const timestampSchema = z
|
|
24
|
+
const secretSchema = z.lazy(() => z.string().regex(/^[A-Za-z0-9_-]{43}$/u));
|
|
25
|
+
const fungiSignatureSchema = z.lazy(() => z.string().regex(/^v1=[a-f0-9]{64}$/u));
|
|
26
|
+
const githubSignatureSchema = z.lazy(() => z.string().regex(/^sha256=[a-f0-9]{64}$/u));
|
|
27
|
+
const githubDeliverySchema = z.lazy(() => z.string().regex(/^[A-Za-z0-9._-]{1,128}$/u));
|
|
28
|
+
const timestampSchema = z.lazy(() => z
|
|
29
29
|
.string()
|
|
30
30
|
.regex(/^\d{1,12}$/u)
|
|
31
31
|
.transform(Number)
|
|
32
|
-
.pipe(z.number().int().nonnegative());
|
|
32
|
+
.pipe(z.number().int().nonnegative()));
|
|
33
33
|
/** A signed timestamp further than this from the receiver's clock is refused. */
|
|
34
34
|
export const WEBHOOK_SIGNATURE_MAX_SKEW_SECONDS = 300;
|
|
35
35
|
const refused = (reason) => ({
|
|
@@ -119,11 +119,11 @@ export function verifySecretUrl(secret, request) {
|
|
|
119
119
|
return refused("bad_signature");
|
|
120
120
|
return { status: "ok", eventId: eventIds.delivery.generate() };
|
|
121
121
|
}
|
|
122
|
-
const standardIdSchema = z.string().regex(/^[\x21-\x7e]{1,256}$/u);
|
|
123
|
-
const standardSignatureSchema = z
|
|
122
|
+
const standardIdSchema = z.lazy(() => z.string().regex(/^[\x21-\x7e]{1,256}$/u));
|
|
123
|
+
const standardSignatureSchema = z.lazy(() => z
|
|
124
124
|
.string()
|
|
125
125
|
.regex(/^v1,[A-Za-z0-9+/]+={0,2}$/u)
|
|
126
|
-
.transform((value) => Buffer.from(value.slice(3), "base64"));
|
|
126
|
+
.transform((value) => Buffer.from(value.slice(3), "base64")));
|
|
127
127
|
/**
|
|
128
128
|
* The Standard Webhooks key bytes behind a binding's secret, in the
|
|
129
129
|
* `whsec_<base64>` form senders (including Oyster's EVENTS delivery) take.
|
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
2
|
import { verifyFungiV1, verifyGithub, verifySecretUrl, verifyStandardWebhooks, } from "./event-verifiers.js";
|
|
3
|
-
const secretSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/u);
|
|
4
|
-
const addressSchema = z.object({
|
|
3
|
+
const secretSchema = z.lazy(() => z.string().regex(/^[A-Za-z0-9_-]{43}$/u));
|
|
4
|
+
const addressSchema = z.lazy(() => z.object({
|
|
5
5
|
teamId: z.string().min(1),
|
|
6
6
|
bindingId: z.string().min(1),
|
|
7
7
|
secretGeneration: z.number().int().nonnegative(),
|
|
8
|
-
});
|
|
8
|
+
}));
|
|
9
9
|
/** A Worker-secret-backed custodian. Per-binding bytes are derived on demand and never enter TeamDO. */
|
|
10
10
|
export function createWebhookTriggerSecrets(masterSecret) {
|
|
11
11
|
const decoded = secretSchema.safeParse(masterSecret);
|