@hookflo/tern 1.0.0

package/dist/verifiers/custom-algorithms.js

@@ -0,0 +1,279 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StripeCustomVerifier = exports.ClerkCustomVerifier = exports.TokenBasedVerifier = void 0;
+exports.createCustomVerifier = createCustomVerifier;
+const base_1 = require("./base");
+// Custom verifier for token-based authentication (like Supabase)
+class TokenBasedVerifier extends base_1.WebhookVerifier {
+    constructor(secret, config, toleranceInSeconds = 300) {
+        super(secret, toleranceInSeconds);
+        this.config = config;
+    }
+    async verify(request) {
+        try {
+            const token = request.headers.get(this.config.headerName);
+            const id = request.headers.get(this.config.customConfig?.idHeader || "x-webhook-id");
+            if (!token) {
+                return {
+                    isValid: false,
+                    error: `Missing token header: ${this.config.headerName}`,
+                    platform: "unknown",
+                };
+            }
+            // Simple token comparison
+            const isValid = this.safeCompare(token, this.secret);
+            if (!isValid) {
+                return {
+                    isValid: false,
+                    error: "Invalid token",
+                    platform: "unknown",
+                };
+            }
+            const rawBody = await request.text();
+            let payload;
+            try {
+                payload = JSON.parse(rawBody);
+            }
+            catch (e) {
+                payload = rawBody;
+            }
+            return {
+                isValid: true,
+                platform: "unknown",
+                payload,
+                metadata: {
+                    id,
+                    algorithm: "token-based",
+                },
+            };
+        }
+        catch (error) {
+            return {
+                isValid: false,
+                error: `Token-based verification error: ${error.message}`,
+                platform: "unknown",
+            };
+        }
+    }
+}
+exports.TokenBasedVerifier = TokenBasedVerifier;
+// Custom verifier for Clerk's specific format
+class ClerkCustomVerifier extends base_1.WebhookVerifier {
+    constructor(secret, config, toleranceInSeconds = 300) {
+        super(secret, toleranceInSeconds);
+        this.config = config;
+    }
+    async verify(request) {
+        try {
+            const body = await request.text();
+            const svixId = request.headers.get("svix-id");
+            const svixTimestamp = request.headers.get("svix-timestamp");
+            const svixSignature = request.headers.get("svix-signature");
+            if (!svixId || !svixTimestamp || !svixSignature) {
+                return {
+                    isValid: false,
+                    error: "Missing required Clerk webhook headers",
+                    platform: "clerk",
+                };
+            }
+            const timestamp = parseInt(svixTimestamp, 10);
+            if (!this.isTimestampValid(timestamp)) {
+                return {
+                    isValid: false,
+                    error: "Webhook timestamp is too old",
+                    platform: "clerk",
+                };
+            }
+            const signedContent = `${svixId}.${svixTimestamp}.${body}`;
+            const secretBytes = new Uint8Array(Buffer.from(this.secret.split("_")[1], "base64"));
+            const { createHmac } = await Promise.resolve().then(() => __importStar(require("crypto")));
+            const expectedSignature = createHmac("sha256", secretBytes)
+                .update(signedContent)
+                .digest("base64");
+            const signatures = svixSignature.split(" ");
+            let isValid = false;
+            for (const sig of signatures) {
+                const [version, signature] = sig.split(",");
+                if (version === "v1" &&
+                    this.safeCompare(signature, expectedSignature)) {
+                    isValid = true;
+                    break;
+                }
+            }
+            if (!isValid) {
+                return {
+                    isValid: false,
+                    error: "Invalid signature",
+                    platform: "clerk",
+                };
+            }
+            return {
+                isValid: true,
+                platform: "clerk",
+                payload: JSON.parse(body),
+                metadata: {
+                    id: svixId,
+                    timestamp: svixTimestamp,
+                    algorithm: "clerk-custom",
+                },
+            };
+        }
+        catch (error) {
+            return {
+                isValid: false,
+                error: error instanceof Error ? error.message : "Unknown error",
+                platform: "clerk",
+            };
+        }
+    }
+}
+exports.ClerkCustomVerifier = ClerkCustomVerifier;
+// Custom verifier for Stripe's specific format
+class StripeCustomVerifier extends base_1.WebhookVerifier {
+    constructor(secret, config, toleranceInSeconds = 300) {
+        super(secret, toleranceInSeconds);
+        this.config = config;
+    }
+    async verify(request) {
+        try {
+            const signature = request.headers.get("Stripe-Signature") ||
+                request.headers.get("stripe-signature") ||
+                request.headers.get("x-stripe-signature");
+            if (!signature) {
+                return {
+                    isValid: false,
+                    error: "Missing Stripe signature header",
+                    platform: "stripe",
+                };
+            }
+            const rawBody = await request.text();
+            const sigParts = signature.split(",");
+            const sigMap = {};
+            for (const part of sigParts) {
+                const [key, value] = part.split("=");
+                if (key && value) {
+                    sigMap[key] = value;
+                }
+            }
+            const timestamp = sigMap.t;
+            const sig = sigMap.v1;
+            if (!timestamp || !sig) {
+                return {
+                    isValid: false,
+                    error: "Invalid Stripe signature format",
+                    platform: "stripe",
+                };
+            }
+            const timestampNum = parseInt(timestamp, 10);
+            if (!this.isTimestampValid(timestampNum)) {
+                return {
+                    isValid: false,
+                    error: "Stripe webhook timestamp expired",
+                    platform: "stripe",
+                };
+            }
+            const signedPayload = `${timestamp}.${rawBody}`;
+            const { createHmac } = await Promise.resolve().then(() => __importStar(require("crypto")));
+            const hmac = createHmac("sha256", this.secret);
+            hmac.update(signedPayload);
+            const expectedSignature = hmac.digest("hex");
+            const isValid = this.safeCompare(sig, expectedSignature);
+            if (!isValid) {
+                console.error("Stripe signature verification failed:", {
+                    received: sig,
+                    expected: expectedSignature,
+                    timestamp,
+                    bodyLength: rawBody.length,
+                    signedPayload: `${signedPayload.substring(0, 50)}...`,
+                });
+                return {
+                    isValid: false,
+                    error: "Invalid Stripe signature",
+                    platform: "stripe",
+                };
+            }
+            let payload;
+            try {
+                payload = JSON.parse(rawBody);
+            }
+            catch (e) {
+                return {
+                    isValid: true,
+                    platform: "stripe",
+                    metadata: {
+                        timestamp,
+                        id: sigMap.id,
+                        algorithm: "stripe-custom",
+                    },
+                };
+            }
+            return {
+                isValid: true,
+                platform: "stripe",
+                payload,
+                metadata: {
+                    timestamp,
+                    id: sigMap.id,
+                    algorithm: "stripe-custom",
+                },
+            };
+        }
+        catch (error) {
+            console.error("Stripe verification error:", error);
+            return {
+                isValid: false,
+                error: `Stripe verification error: ${error.message}`,
+                platform: "stripe",
+            };
+        }
+    }
+}
+exports.StripeCustomVerifier = StripeCustomVerifier;
+// Factory function for custom verifiers
+function createCustomVerifier(secret, config, toleranceInSeconds = 300) {
+    const customType = config.customConfig?.type;
+    switch (customType) {
+        case "token-based":
+            return new TokenBasedVerifier(secret, config, toleranceInSeconds);
+        case "clerk-custom":
+            return new ClerkCustomVerifier(secret, config, toleranceInSeconds);
+        case "stripe-custom":
+            return new StripeCustomVerifier(secret, config, toleranceInSeconds);
+        default:
+            // Fallback to token-based for unknown custom types
+            return new TokenBasedVerifier(secret, config, toleranceInSeconds);
+    }
+}

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@hookflo/tern",
+  "version": "1.0.0",
+  "description": "A robust, scalable webhook verification framework supporting multiple platforms and signature algorithms",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "node dist/test.js",
+    "lint": "eslint src/**/*.ts",
+    "lint:fix": "eslint 'src/**/*.ts' --fix",
+    "format": "prettier --write src/**/*.ts",
+    "prepare": "npm run build",
+    "publish": "npm publish",
+    "clean": "rm -rf dist",
+    "prebuild": "npm run clean"
+  },
+  "keywords": [
+    "Hookflo",
+    "webhook",
+    "verification",
+    "security",
+    "hmac",
+    "signature",
+    "github",
+    "stripe",
+    "clerk",
+    "supabase",
+    "typescript",
+    "node",
+    "express",
+    "nextjs"
+  ],
+  "author": "Prateek Jain",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Hookflo/tern"
+  },
+  "bugs": {
+    "url": "https://github.com/Hookflo/tern/issues"
+  },
+  "homepage": "https://github.com/Hookflo/tern#readme",
+  "devDependencies": {
+    "@types/express": "^5.0.3",
+    "@types/jest": "29.5.0",
+    "@types/node": "20.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.39.0",
+    "@typescript-eslint/parser": "^8.39.0",
+    "eslint": "^8.57.1",
+    "eslint-config-airbnb-base": "^15.0.0",
+    "eslint-plugin-import": "^2.32.0",
+    "jest": "29.5.0",
+    "prettier": "3.0.0",
+    "ts-jest": "29.1.0",
+    "typescript": "^5.0.0"
+  },
+  "engines": {
+    "node": ">=16.0.0"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}