@hookflo/tern 1.0.0 → 1.0.2

package/dist/verifiers/algorithms.js

@@ -1,13 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HMACSHA512Verifier = exports.HMACSHA1Verifier = exports.HMACSHA256Verifier = exports.AlgorithmBasedVerifier = void 0;
+exports.HMACSHA512Verifier = exports.HMACSHA1Verifier = exports.HMACSHA256Verifier = exports.GenericHMACVerifier = exports.AlgorithmBasedVerifier = void 0;
 exports.createAlgorithmVerifier = createAlgorithmVerifier;
 const crypto_1 = require("crypto");
 const base_1 = require("./base");
 class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
-    constructor(secret, config, toleranceInSeconds = 300) {
+    constructor(secret, config, platform, toleranceInSeconds = 300) {
         super(secret, toleranceInSeconds);
         this.config = config;
+        this.platform = platform;
     }
     extractSignature(request) {
         const headerValue = request.headers.get(this.config.headerName);
@@ -15,9 +16,8 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
             return null;
         switch (this.config.headerFormat) {
             case "prefixed":
-                return headerValue.startsWith(this.config.prefix || "")
-                    ? headerValue.substring((this.config.prefix || "").length)
-                    : null;
+                // For GitHub, return the full signature including prefix for comparison
+                return headerValue;
             case "comma-separated":
                 // Handle comma-separated format like Stripe: "t=1234567890,v1=abc123"
                 const parts = headerValue.split(",");
@@ -31,6 +31,17 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
                 return sigMap.v1 || sigMap.signature || null;
             case "raw":
             default:
+                // For Clerk, handle space-separated signatures
+                if (this.platform === "clerk") {
+                    const signatures = headerValue.split(" ");
+                    for (const sig of signatures) {
+                        const [version, signature] = sig.split(",");
+                        if (version === "v1") {
+                            return signature;
+                        }
+                    }
+                    return null;
+                }
                 return headerValue;
         }
     }
@@ -52,18 +63,62 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
                 return parseInt(timestampHeader, 10);
         }
     }
-    formatPayload(rawBody, timestamp) {
+    extractTimestampFromSignature(request) {
+        // For platforms like Stripe where timestamp is embedded in signature
+        if (this.config.headerFormat === "comma-separated") {
+            const headerValue = request.headers.get(this.config.headerName);
+            if (!headerValue)
+                return null;
+            const parts = headerValue.split(",");
+            const sigMap = {};
+            for (const part of parts) {
+                const [key, value] = part.split("=");
+                if (key && value) {
+                    sigMap[key] = value;
+                }
+            }
+            return sigMap.t ? parseInt(sigMap.t, 10) : null;
+        }
+        return null;
+    }
+    formatPayload(rawBody, request) {
         switch (this.config.payloadFormat) {
             case "timestamped":
+                // For Stripe, timestamp is embedded in signature
+                const timestamp = this.extractTimestampFromSignature(request) ||
+                    this.extractTimestamp(request);
                 return timestamp ? `${timestamp}.${rawBody}` : rawBody;
             case "custom":
-                // Custom payload formatting logic can be added here
-                return rawBody;
+                return this.formatCustomPayload(rawBody, request);
             case "raw":
             default:
                 return rawBody;
         }
     }
+    formatCustomPayload(rawBody, request) {
+        if (!this.config.customConfig?.payloadFormat) {
+            return rawBody;
+        }
+        const customFormat = this.config.customConfig.payloadFormat;
+        // Handle Clerk-style format: {id}.{timestamp}.{body}
+        if (customFormat.includes("{id}") && customFormat.includes("{timestamp}")) {
+            const id = request.headers.get(this.config.customConfig.idHeader || "x-webhook-id");
+            const timestamp = request.headers.get(this.config.timestampHeader || "x-webhook-timestamp");
+            return customFormat
+                .replace("{id}", id || "")
+                .replace("{timestamp}", timestamp || "")
+                .replace("{body}", rawBody);
+        }
+        // Handle Stripe-style format: {timestamp}.{body}
+        if (customFormat.includes("{timestamp}") &&
+            customFormat.includes("{body}")) {
+            const timestamp = this.extractTimestamp(request);
+            return customFormat
+                .replace("{timestamp}", timestamp?.toString() || "")
+                .replace("{body}", rawBody);
+        }
+        return rawBody;
+    }
     verifyHMAC(payload, signature, algorithm = "sha256") {
         const hmac = (0, crypto_1.createHmac)(algorithm, this.secret);
         hmac.update(payload);
@@ -76,9 +131,54 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
         const expectedSignature = `${this.config.prefix || ""}${hmac.digest("hex")}`;
         return this.safeCompare(signature, expectedSignature);
     }
+    verifyHMACWithBase64(payload, signature, algorithm = "sha256") {
+        // For platforms like Clerk that use base64 encoding
+        const secretBytes = new Uint8Array(Buffer.from(this.secret.split("_")[1], "base64"));
+        const hmac = (0, crypto_1.createHmac)(algorithm, secretBytes);
+        hmac.update(payload);
+        const expectedSignature = hmac.digest("base64");
+        return this.safeCompare(signature, expectedSignature);
+    }
+    extractMetadata(request) {
+        const metadata = {
+            algorithm: this.config.algorithm,
+        };
+        // Add timestamp if available
+        const timestamp = this.extractTimestamp(request);
+        if (timestamp) {
+            metadata.timestamp = timestamp.toString();
+        }
+        // Add platform-specific metadata
+        switch (this.platform) {
+            case "github":
+                metadata.event = request.headers.get("x-github-event");
+                metadata.delivery = request.headers.get("x-github-delivery");
+                break;
+            case "stripe":
+                // Extract Stripe-specific metadata from signature
+                const headerValue = request.headers.get(this.config.headerName);
+                if (headerValue && this.config.headerFormat === "comma-separated") {
+                    const parts = headerValue.split(",");
+                    const sigMap = {};
+                    for (const part of parts) {
+                        const [key, value] = part.split("=");
+                        if (key && value) {
+                            sigMap[key] = value;
+                        }
+                    }
+                    metadata.id = sigMap.id;
+                }
+                break;
+            case "clerk":
+                metadata.id = request.headers.get("svix-id");
+                break;
+        }
+        return metadata;
+    }
 }
 exports.AlgorithmBasedVerifier = AlgorithmBasedVerifier;
-class HMACSHA256Verifier extends AlgorithmBasedVerifier {
+// Generic HMAC Verifier that handles all HMAC-based algorithms
+class GenericHMACVerifier extends AlgorithmBasedVerifier {
     async verify(request) {
         try {
             const signature = this.extractSignature(request);
@@ -86,88 +186,53 @@ class HMACSHA256Verifier extends AlgorithmBasedVerifier {
                 return {
                     isValid: false,
                     error: `Missing signature header: ${this.config.headerName}`,
-                    platform: "unknown",
+                    platform: this.platform,
                 };
             }
             const rawBody = await request.text();
-            const timestamp = this.extractTimestamp(request);
+            // Extract timestamp based on platform configuration
+            let timestamp = null;
+            if (this.config.headerFormat === "comma-separated") {
+                // For platforms like Stripe where timestamp is embedded in signature
+                timestamp = this.extractTimestampFromSignature(request);
+            }
+            else {
+                // For platforms with separate timestamp header
+                timestamp = this.extractTimestamp(request);
+            }
+            // Validate timestamp if required
             if (timestamp && !this.isTimestampValid(timestamp)) {
                 return {
                     isValid: false,
                     error: "Webhook timestamp expired",
-                    platform: "unknown",
+                    platform: this.platform,
                 };
             }
-            const payload = this.formatPayload(rawBody, timestamp);
-            const isValid = this.config.prefix
-                ? this.verifyHMACWithPrefix(payload, signature, "sha256")
-                : this.verifyHMAC(payload, signature, "sha256");
-            if (!isValid) {
-                return {
-                    isValid: false,
-                    error: "Invalid signature",
-                    platform: "unknown",
-                };
+            // Format payload according to platform requirements
+            const payload = this.formatPayload(rawBody, request);
+            // Verify signature based on platform configuration
+            let isValid = false;
+            const algorithm = this.config.algorithm.replace("hmac-", "");
+            if (this.config.customConfig?.encoding === "base64") {
+                // For platforms like Clerk that use base64 encoding
+                isValid = this.verifyHMACWithBase64(payload, signature, algorithm);
             }
-            let parsedPayload;
-            try {
-                parsedPayload = JSON.parse(rawBody);
+            else if (this.config.headerFormat === "prefixed") {
+                // For platforms like GitHub that use prefixed signatures
+                isValid = this.verifyHMACWithPrefix(payload, signature, algorithm);
             }
-            catch (e) {
-                // Return valid even if JSON parsing fails
-                parsedPayload = rawBody;
+            else {
+                // Standard HMAC verification
+                isValid = this.verifyHMAC(payload, signature, algorithm);
             }
-            return {
-                isValid: true,
-                platform: "unknown",
-                payload: parsedPayload,
-                metadata: {
-                    timestamp: timestamp?.toString(),
-                    algorithm: "hmac-sha256",
-                },
-            };
-        }
-        catch (error) {
-            return {
-                isValid: false,
-                error: `HMAC-SHA256 verification error: ${error.message}`,
-                platform: "unknown",
-            };
-        }
-    }
-}
-exports.HMACSHA256Verifier = HMACSHA256Verifier;
-class HMACSHA1Verifier extends AlgorithmBasedVerifier {
-    async verify(request) {
-        try {
-            const signature = this.extractSignature(request);
-            if (!signature) {
-                return {
-                    isValid: false,
-                    error: `Missing signature header: ${this.config.headerName}`,
-                    platform: "unknown",
-                };
-            }
-            const rawBody = await request.text();
-            const timestamp = this.extractTimestamp(request);
-            if (timestamp && !this.isTimestampValid(timestamp)) {
-                return {
-                    isValid: false,
-                    error: "Webhook timestamp expired",
-                    platform: "unknown",
-                };
-            }
-            const payload = this.formatPayload(rawBody, timestamp);
-            const isValid = this.config.prefix
-                ? this.verifyHMACWithPrefix(payload, signature, "sha1")
-                : this.verifyHMAC(payload, signature, "sha1");
             if (!isValid) {
                 return {
                     isValid: false,
                     error: "Invalid signature",
-                    platform: "unknown",
+                    platform: this.platform,
                 };
             }
+            // Parse payload
             let parsedPayload;
             try {
                 parsedPayload = JSON.parse(rawBody);
@@ -175,93 +240,51 @@ class HMACSHA1Verifier extends AlgorithmBasedVerifier {
             catch (e) {
                 parsedPayload = rawBody;
             }
+            // Extract platform-specific metadata
+            const metadata = this.extractMetadata(request);
             return {
                 isValid: true,
-                platform: "unknown",
+                platform: this.platform,
                 payload: parsedPayload,
-                metadata: {
-                    timestamp: timestamp?.toString(),
-                    algorithm: "hmac-sha1",
-                },
+                metadata,
             };
         }
         catch (error) {
             return {
                 isValid: false,
-                error: `HMAC-SHA1 verification error: ${error.message}`,
-                platform: "unknown",
+                error: `${this.platform} verification error: ${error.message}`,
+                platform: this.platform,
             };
         }
     }
 }
+exports.GenericHMACVerifier = GenericHMACVerifier;
+// Legacy verifiers for backward compatibility
+class HMACSHA256Verifier extends GenericHMACVerifier {
+    constructor(secret, config, platform = "unknown", toleranceInSeconds = 300) {
+        super(secret, config, platform, toleranceInSeconds);
+    }
+}
+exports.HMACSHA256Verifier = HMACSHA256Verifier;
+class HMACSHA1Verifier extends GenericHMACVerifier {
+    constructor(secret, config, platform = "unknown", toleranceInSeconds = 300) {
+        super(secret, config, platform, toleranceInSeconds);
+    }
+}
 exports.HMACSHA1Verifier = HMACSHA1Verifier;
-class HMACSHA512Verifier extends AlgorithmBasedVerifier {
-    async verify(request) {
-        try {
-            const signature = this.extractSignature(request);
-            if (!signature) {
-                return {
-                    isValid: false,
-                    error: `Missing signature header: ${this.config.headerName}`,
-                    platform: "unknown",
-                };
-            }
-            const rawBody = await request.text();
-            const timestamp = this.extractTimestamp(request);
-            if (timestamp && !this.isTimestampValid(timestamp)) {
-                return {
-                    isValid: false,
-                    error: "Webhook timestamp expired",
-                    platform: "unknown",
-                };
-            }
-            const payload = this.formatPayload(rawBody, timestamp);
-            const isValid = this.config.prefix
-                ? this.verifyHMACWithPrefix(payload, signature, "sha512")
-                : this.verifyHMAC(payload, signature, "sha512");
-            if (!isValid) {
-                return {
-                    isValid: false,
-                    error: "Invalid signature",
-                    platform: "unknown",
-                };
-            }
-            let parsedPayload;
-            try {
-                parsedPayload = JSON.parse(rawBody);
-            }
-            catch (e) {
-                parsedPayload = rawBody;
-            }
-            return {
-                isValid: true,
-                platform: "unknown",
-                payload: parsedPayload,
-                metadata: {
-                    timestamp: timestamp?.toString(),
-                    algorithm: "hmac-sha512",
-                },
-            };
-        }
-        catch (error) {
-            return {
-                isValid: false,
-                error: `HMAC-SHA512 verification error: ${error.message}`,
-                platform: "unknown",
-            };
-        }
+class HMACSHA512Verifier extends GenericHMACVerifier {
+    constructor(secret, config, platform = "unknown", toleranceInSeconds = 300) {
+        super(secret, config, platform, toleranceInSeconds);
     }
 }
 exports.HMACSHA512Verifier = HMACSHA512Verifier;
 // Factory function to create verifiers based on algorithm
-function createAlgorithmVerifier(secret, config, toleranceInSeconds = 300) {
+function createAlgorithmVerifier(secret, config, platform = "unknown", toleranceInSeconds = 300) {
     switch (config.algorithm) {
         case "hmac-sha256":
-            return new HMACSHA256Verifier(secret, config, toleranceInSeconds);
         case "hmac-sha1":
-            return new HMACSHA1Verifier(secret, config, toleranceInSeconds);
         case "hmac-sha512":
-            return new HMACSHA512Verifier(secret, config, toleranceInSeconds);
+            return new GenericHMACVerifier(secret, config, platform, toleranceInSeconds);
         case "rsa-sha256":
         case "ed25519":
         case "custom":

package/dist/verifiers/custom-algorithms.d.ts

@@ -5,14 +5,4 @@ export declare class TokenBasedVerifier extends WebhookVerifier {
     constructor(secret: string, config: SignatureConfig, toleranceInSeconds?: number);
     verify(request: Request): Promise<WebhookVerificationResult>;
 }
-export declare class ClerkCustomVerifier extends WebhookVerifier {
-    private config;
-    constructor(secret: string, config: SignatureConfig, toleranceInSeconds?: number);
-    verify(request: Request): Promise<WebhookVerificationResult>;
-}
-export declare class StripeCustomVerifier extends WebhookVerifier {
-    private config;
-    constructor(secret: string, config: SignatureConfig, toleranceInSeconds?: number);
-    verify(request: Request): Promise<WebhookVerificationResult>;
-}
 export declare function createCustomVerifier(secret: string, config: SignatureConfig, toleranceInSeconds?: number): WebhookVerifier;

package/dist/verifiers/custom-algorithms.js

@@ -1,42 +1,9 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.StripeCustomVerifier = exports.ClerkCustomVerifier = exports.TokenBasedVerifier = void 0;
+exports.TokenBasedVerifier = void 0;
 exports.createCustomVerifier = createCustomVerifier;
 const base_1 = require("./base");
-// Custom verifier for token-based authentication (like Supabase)
+// Token-based verifier for platforms like Supabase
 class TokenBasedVerifier extends base_1.WebhookVerifier {
     constructor(secret, config, toleranceInSeconds = 300) {
         super(secret, toleranceInSeconds);
@@ -50,7 +17,7 @@ class TokenBasedVerifier extends base_1.WebhookVerifier {
                 return {
                     isValid: false,
                     error: `Missing token header: ${this.config.headerName}`,
-                    platform: "unknown",
+                    platform: "custom",
                 };
             }
             // Simple token comparison
@@ -59,7 +26,7 @@ class TokenBasedVerifier extends base_1.WebhookVerifier {
                 return {
                     isValid: false,
                     error: "Invalid token",
-                    platform: "unknown",
+                    platform: "custom",
                 };
             }
             const rawBody = await request.text();
@@ -72,7 +39,7 @@ class TokenBasedVerifier extends base_1.WebhookVerifier {
             }
             return {
                 isValid: true,
-                platform: "unknown",
+                platform: "custom",
                 payload,
                 metadata: {
                     id,
@@ -84,194 +51,18 @@ class TokenBasedVerifier extends base_1.WebhookVerifier {
             return {
                 isValid: false,
                 error: `Token-based verification error: ${error.message}`,
-                platform: "unknown",
+                platform: "custom",
             };
         }
     }
 }
 exports.TokenBasedVerifier = TokenBasedVerifier;
-// Custom verifier for Clerk's specific format
-class ClerkCustomVerifier extends base_1.WebhookVerifier {
-    constructor(secret, config, toleranceInSeconds = 300) {
-        super(secret, toleranceInSeconds);
-        this.config = config;
-    }
-    async verify(request) {
-        try {
-            const body = await request.text();
-            const svixId = request.headers.get("svix-id");
-            const svixTimestamp = request.headers.get("svix-timestamp");
-            const svixSignature = request.headers.get("svix-signature");
-            if (!svixId || !svixTimestamp || !svixSignature) {
-                return {
-                    isValid: false,
-                    error: "Missing required Clerk webhook headers",
-                    platform: "clerk",
-                };
-            }
-            const timestamp = parseInt(svixTimestamp, 10);
-            if (!this.isTimestampValid(timestamp)) {
-                return {
-                    isValid: false,
-                    error: "Webhook timestamp is too old",
-                    platform: "clerk",
-                };
-            }
-            const signedContent = `${svixId}.${svixTimestamp}.${body}`;
-            const secretBytes = new Uint8Array(Buffer.from(this.secret.split("_")[1], "base64"));
-            const { createHmac } = await Promise.resolve().then(() => __importStar(require("crypto")));
-            const expectedSignature = createHmac("sha256", secretBytes)
-                .update(signedContent)
-                .digest("base64");
-            const signatures = svixSignature.split(" ");
-            let isValid = false;
-            for (const sig of signatures) {
-                const [version, signature] = sig.split(",");
-                if (version === "v1" &&
-                    this.safeCompare(signature, expectedSignature)) {
-                    isValid = true;
-                    break;
-                }
-            }
-            if (!isValid) {
-                return {
-                    isValid: false,
-                    error: "Invalid signature",
-                    platform: "clerk",
-                };
-            }
-            return {
-                isValid: true,
-                platform: "clerk",
-                payload: JSON.parse(body),
-                metadata: {
-                    id: svixId,
-                    timestamp: svixTimestamp,
-                    algorithm: "clerk-custom",
-                },
-            };
-        }
-        catch (error) {
-            return {
-                isValid: false,
-                error: error instanceof Error ? error.message : "Unknown error",
-                platform: "clerk",
-            };
-        }
-    }
-}
-exports.ClerkCustomVerifier = ClerkCustomVerifier;
-// Custom verifier for Stripe's specific format
-class StripeCustomVerifier extends base_1.WebhookVerifier {
-    constructor(secret, config, toleranceInSeconds = 300) {
-        super(secret, toleranceInSeconds);
-        this.config = config;
-    }
-    async verify(request) {
-        try {
-            const signature = request.headers.get("Stripe-Signature") ||
-                request.headers.get("stripe-signature") ||
-                request.headers.get("x-stripe-signature");
-            if (!signature) {
-                return {
-                    isValid: false,
-                    error: "Missing Stripe signature header",
-                    platform: "stripe",
-                };
-            }
-            const rawBody = await request.text();
-            const sigParts = signature.split(",");
-            const sigMap = {};
-            for (const part of sigParts) {
-                const [key, value] = part.split("=");
-                if (key && value) {
-                    sigMap[key] = value;
-                }
-            }
-            const timestamp = sigMap.t;
-            const sig = sigMap.v1;
-            if (!timestamp || !sig) {
-                return {
-                    isValid: false,
-                    error: "Invalid Stripe signature format",
-                    platform: "stripe",
-                };
-            }
-            const timestampNum = parseInt(timestamp, 10);
-            if (!this.isTimestampValid(timestampNum)) {
-                return {
-                    isValid: false,
-                    error: "Stripe webhook timestamp expired",
-                    platform: "stripe",
-                };
-            }
-            const signedPayload = `${timestamp}.${rawBody}`;
-            const { createHmac } = await Promise.resolve().then(() => __importStar(require("crypto")));
-            const hmac = createHmac("sha256", this.secret);
-            hmac.update(signedPayload);
-            const expectedSignature = hmac.digest("hex");
-            const isValid = this.safeCompare(sig, expectedSignature);
-            if (!isValid) {
-                console.error("Stripe signature verification failed:", {
-                    received: sig,
-                    expected: expectedSignature,
-                    timestamp,
-                    bodyLength: rawBody.length,
-                    signedPayload: `${signedPayload.substring(0, 50)}...`,
-                });
-                return {
-                    isValid: false,
-                    error: "Invalid Stripe signature",
-                    platform: "stripe",
-                };
-            }
-            let payload;
-            try {
-                payload = JSON.parse(rawBody);
-            }
-            catch (e) {
-                return {
-                    isValid: true,
-                    platform: "stripe",
-                    metadata: {
-                        timestamp,
-                        id: sigMap.id,
-                        algorithm: "stripe-custom",
-                    },
-                };
-            }
-            return {
-                isValid: true,
-                platform: "stripe",
-                payload,
-                metadata: {
-                    timestamp,
-                    id: sigMap.id,
-                    algorithm: "stripe-custom",
-                },
-            };
-        }
-        catch (error) {
-            console.error("Stripe verification error:", error);
-            return {
-                isValid: false,
-                error: `Stripe verification error: ${error.message}`,
-                platform: "stripe",
-            };
-        }
-    }
-}
-exports.StripeCustomVerifier = StripeCustomVerifier;
-// Factory function for custom verifiers
+// Factory function to create custom verifiers
 function createCustomVerifier(secret, config, toleranceInSeconds = 300) {
     const customType = config.customConfig?.type;
     switch (customType) {
         case "token-based":
             return new TokenBasedVerifier(secret, config, toleranceInSeconds);
-        case "clerk-custom":
-            return new ClerkCustomVerifier(secret, config, toleranceInSeconds);
-        case "stripe-custom":
-            return new StripeCustomVerifier(secret, config, toleranceInSeconds);
         default:
             // Fallback to token-based for unknown custom types
             return new TokenBasedVerifier(secret, config, toleranceInSeconds);