@hookflo/tern 2.2.10 → 3.0.1

package/dist/test.js

@@ -65,9 +65,35 @@ function createWorkOSSignature(body, secret, timestamp) {
     hmac.update(signedPayload);
     return `t=${timestamp},v1=${hmac.digest('hex')}`;
 }
+function createSentrySignature(body, secret) {
+    const hmac = (0, crypto_1.createHmac)('sha256', secret);
+    hmac.update(JSON.stringify(JSON.parse(body)));
+    return hmac.digest('hex');
+}
+function createSentryIssueAlertSignature(issueAlertObject, secret) {
+    const hmac = (0, crypto_1.createHmac)('sha256', secret);
+    hmac.update(JSON.stringify(issueAlertObject));
+    return hmac.digest('hex');
+}
+function createGrafanaSignature(body, secret, timestamp) {
+    const payload = timestamp ? `${timestamp}.${body}` : body;
+    const hmac = (0, crypto_1.createHmac)('sha256', secret);
+    hmac.update(payload);
+    return hmac.digest('hex');
+}
+function createDopplerSignature(body, secret) {
+    const hmac = (0, crypto_1.createHmac)('sha256', secret);
+    hmac.update(body);
+    return `sha256=${hmac.digest('hex')}`;
+}
+function createSanitySignature(body, secret, timestamp) {
+    const hmac = (0, crypto_1.createHmac)('sha256', secret);
+    hmac.update(`${timestamp}.${body}`);
+    return `t=${timestamp},v1=${hmac.digest('hex')}`;
+}
 function createFalPayloadToSign(body, requestId, userId, timestamp) {
     const bodyHash = (0, crypto_1.createHash)('sha256').update(body).digest('hex');
-    return `${requestId}.${userId}.${timestamp}.${bodyHash}`;
+    return `${requestId}\n${userId}\n${timestamp}\n${bodyHash}`;
 }
 async function runTests() {
     console.log('🧪 Running Webhook Verification Tests...\n');
@@ -81,7 +107,8 @@ async function runTests() {
             'content-type': 'application/json',
         });
         const stripeResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(stripeRequest, 'stripe', testSecret);
-        console.log('   ✅ Stripe:', stripeResult.isValid ? 'PASSED' : 'FAILED');
+        const stripePassed = stripeResult.isValid && Boolean(stripeResult.eventId?.startsWith('stripe:'));
+        console.log('   ✅ Stripe:', stripePassed ? 'PASSED' : 'FAILED');
         if (!stripeResult.isValid) {
             console.log('   ❌ Error:', stripeResult.error);
         }
@@ -181,7 +208,7 @@ async function runTests() {
     catch (error) {
         console.log('   ❌ Dodo Payments test failed:', error);
     }
-    // Test 5: Token-based (Supabase)
+    // Test 5: Token-based authentication helper
     console.log('\n5. Testing Token-based Authentication...');
     try {
         const webhookId = 'test-webhook-id';
@@ -191,8 +218,10 @@ async function runTests() {
             'x-webhook-token': webhookToken,
             'content-type': 'application/json',
         });
-        const tokenResult = await index_1.WebhookVerificationService.verifyTokenBased(tokenRequest, webhookId, webhookToken);
-        console.log('   ✅ Token-based:', tokenResult.isValid ? 'PASSED' : 'FAILED');
+        const tokenResult = await index_1.WebhookVerificationService.verifyTokenAuth(tokenRequest.clone(), webhookId, webhookToken);
+        const tokenAliasResult = await index_1.WebhookVerificationService.verifyTokenBased(tokenRequest.clone(), webhookId, webhookToken);
+        const tokenPassed = tokenResult.isValid && tokenAliasResult.isValid;
+        console.log('   ✅ Token-based:', tokenPassed ? 'PASSED' : 'FAILED');
         if (!tokenResult.isValid) {
             console.log('   ❌ Error:', tokenResult.error);
         }
@@ -200,6 +229,88 @@ async function runTests() {
     catch (error) {
         console.log('   ❌ Token-based test failed:', error);
     }
+    // Test 5.5: Sentry webhook verification (standard + issue alert fallback)
+    console.log('\n5.5. Testing Sentry Webhook...');
+    try {
+        const timestamp = Math.floor(Date.now() / 1000);
+        const requestId = 'sentry-request-id-123';
+        const sentryBody = JSON.stringify({
+            action: 'triggered',
+            data: {
+                issue_alert: {
+                    id: 'alert-1',
+                    title: 'CPU high',
+                    project: 'infra',
+                },
+            },
+        });
+        const sentryRequest = createMockRequest({
+            'sentry-hook-signature': createSentrySignature(sentryBody, testSecret),
+            'sentry-hook-timestamp': timestamp.toString(),
+            'request-id': requestId,
+            'content-type': 'application/json',
+        }, sentryBody);
+        const sentryResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(sentryRequest, 'sentry', testSecret);
+        const sentryIssueAlertRequest = createMockRequest({
+            'sentry-hook-signature': createSentryIssueAlertSignature({ id: 'alert-1', title: 'CPU high', project: 'infra' }, testSecret),
+            'sentry-hook-timestamp': timestamp.toString(),
+            'request-id': `${requestId}-issue-alert`,
+            'content-type': 'application/json',
+        }, sentryBody);
+        const sentryIssueAlertResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(sentryIssueAlertRequest, 'sentry', testSecret);
+        const sentryPassed = sentryResult.isValid && sentryIssueAlertResult.isValid && sentryResult.eventId?.startsWith('sentry:');
+        console.log('   ✅ Sentry:', sentryPassed ? 'PASSED' : 'FAILED');
+    }
+    catch (error) {
+        console.log('   ❌ Sentry test failed:', error);
+    }
+    // Test 5.6: Grafana webhook verification
+    console.log('\n5.6. Testing Grafana Webhook...');
+    try {
+        const timestamp = Math.floor(Date.now() / 1000);
+        const grafanaSignature = createGrafanaSignature(testBody, testSecret, timestamp);
+        const grafanaRequest = createMockRequest({
+            'x-grafana-alerting-signature': grafanaSignature,
+            'x-grafana-alerting-timestamp': timestamp.toString(),
+            'content-type': 'application/json',
+        });
+        const grafanaResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(grafanaRequest, 'grafana', testSecret);
+        console.log('   ✅ Grafana:', grafanaResult.isValid ? 'PASSED' : 'FAILED');
+    }
+    catch (error) {
+        console.log('   ❌ Grafana test failed:', error);
+    }
+    // Test 5.7: Doppler webhook verification
+    console.log('\n5.7. Testing Doppler Webhook...');
+    try {
+        const dopplerRequest = createMockRequest({
+            'x-doppler-signature': createDopplerSignature(testBody, testSecret),
+            'content-type': 'application/json',
+        });
+        const dopplerResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(dopplerRequest, 'doppler', testSecret);
+        const dopplerPassed = dopplerResult.isValid && Boolean(dopplerResult.eventId?.startsWith('doppler:'));
+        console.log('   ✅ Doppler:', dopplerPassed ? 'PASSED' : 'FAILED');
+    }
+    catch (error) {
+        console.log('   ❌ Doppler test failed:', error);
+    }
+    // Test 5.8: Sanity webhook verification
+    console.log('\n5.8. Testing Sanity Webhook...');
+    try {
+        const timestamp = Math.floor(Date.now() / 1000);
+        const idempotencyKey = 'sanity-idem-123';
+        const sanityRequest = createMockRequest({
+            'sanity-webhook-signature': createSanitySignature(testBody, testSecret, timestamp),
+            'idempotency-key': idempotencyKey,
+            'content-type': 'application/json',
+        });
+        const sanityResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(sanityRequest, 'sanity', testSecret);
+        const sanityPassed = sanityResult.isValid && sanityResult.eventId === `sanity:${idempotencyKey}`;
+        console.log('   ✅ Sanity:', sanityPassed ? 'PASSED' : 'FAILED');
+    }
+    catch (error) {
+        console.log('   ❌ Sanity test failed:', error);
+    }
     // Test 6: Invalid signatures
     console.log('\n6. Testing Invalid Signatures...');
     try {
@@ -388,24 +499,8 @@ async function runTests() {
     catch (error) {
         console.log('   ❌ Paddle test failed:', error);
     }
-    // Test 16: Auth0
-    console.log('\n16. Testing Auth0 webhook...');
-    try {
-        const hmac = (0, crypto_1.createHmac)('sha256', testSecret);
-        hmac.update(testBody);
-        const signature = hmac.digest('hex');
-        const request = createMockRequest({
-            'x-auth0-signature': signature,
-            'content-type': 'application/json',
-        });
-        const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, 'auth0', testSecret);
-        console.log('   ✅ Auth0:', result.isValid ? 'PASSED' : 'FAILED');
-    }
-    catch (error) {
-        console.log('   ❌ Auth0 test failed:', error);
-    }
-    // Test 17: WorkOS
-    console.log('\n17. Testing WorkOS webhook...');
+    // Test 16: WorkOS
+    console.log('\n16. Testing WorkOS webhook...');
     try {
         const timestamp = Math.floor(Date.now() / 1000);
         const signature = createWorkOSSignature(testBody, testSecret, timestamp);
@@ -420,7 +515,7 @@ async function runTests() {
         console.log('   ❌ WorkOS test failed:', error);
     }
     // Test 17.5: Shopify
-    console.log('\n17.5. Testing Shopify webhook...');
+    console.log('\n17. Testing Shopify webhook...');
     try {
         const signature = createShopifySignature(testBody, testSecret);
         const request = createMockRequest({
@@ -501,11 +596,11 @@ async function runTests() {
         const timestamp = Math.floor(Date.now() / 1000).toString();
         const payloadToSign = createFalPayloadToSign(testBody, requestId, userId, timestamp);
         const payloadBytes = new Uint8Array(Buffer.from(payloadToSign));
-        const signature = (0, crypto_1.sign)(null, payloadBytes, privateKey).toString('base64');
+        const signature = (0, crypto_1.sign)(null, payloadBytes, privateKey).toString('hex');
         const request = createMockRequest({
             'x-fal-webhook-signature': signature,
-            'x-fal-request-id': requestId,
-            'x-fal-user-id': userId,
+            'x-fal-webhook-request-id': requestId,
+            'x-fal-webhook-user-id': userId,
             'x-fal-webhook-timestamp': timestamp,
             'content-type': 'application/json',
         });
@@ -519,8 +614,8 @@ async function runTests() {
                 payloadFormat: 'custom',
                 customConfig: {
                     publicKey: publicKey.export({ type: 'spki', format: 'pem' }).toString(),
-                    requestIdHeader: 'x-fal-request-id',
-                    userIdHeader: 'x-fal-user-id',
+                    requestIdHeader: 'x-fal-webhook-request-id',
+                    userIdHeader: 'x-fal-webhook-user-id',
                     timestampHeader: 'x-fal-webhook-timestamp',
                 },
             },

package/dist/types.d.ts

@@ -1,4 +1,4 @@
-export type WebhookPlatform = 'custom' | 'clerk' | 'supabase' | 'github' | 'stripe' | 'shopify' | 'vercel' | 'polar' | 'dodopayments' | 'gitlab' | 'paddle' | 'razorpay' | 'lemonsqueezy' | 'auth0' | 'workos' | 'woocommerce' | 'replicateai' | 'falai' | 'unknown';
+export type WebhookPlatform = 'custom' | 'clerk' | 'github' | 'stripe' | 'shopify' | 'vercel' | 'polar' | 'dodopayments' | 'gitlab' | 'paddle' | 'razorpay' | 'lemonsqueezy' | 'workos' | 'woocommerce' | 'replicateai' | 'falai' | 'sentry' | 'grafana' | 'doppler' | 'sanity' | 'unknown';
 export declare enum WebhookPlatformKeys {
     GitHub = "github",
     Stripe = "stripe",
@@ -7,16 +7,18 @@ export declare enum WebhookPlatformKeys {
     Shopify = "shopify",
     Vercel = "vercel",
     Polar = "polar",
-    Supabase = "supabase",
     GitLab = "gitlab",
     Paddle = "paddle",
     Razorpay = "razorpay",
     LemonSqueezy = "lemonsqueezy",
-    Auth0 = "auth0",
     WorkOS = "workos",
     WooCommerce = "woocommerce",
     ReplicateAI = "replicateai",
     FalAI = "falai",
+    Sentry = "sentry",
+    Grafana = "grafana",
+    Doppler = "doppler",
+    Sanity = "sanity",
     Custom = "custom",
     Unknown = "unknown"
 }
@@ -28,7 +30,8 @@ export interface SignatureConfig {
     prefix?: string;
     timestampHeader?: string;
     timestampFormat?: 'unix' | 'iso' | 'custom';
-    payloadFormat?: 'raw' | 'timestamped' | 'custom';
+    payloadFormat?: 'raw' | 'timestamped' | 'json-stringified' | 'custom';
+    idHeader?: string;
     customConfig?: Record<string, any>;
 }
 export type WebhookErrorCode = 'MISSING_SIGNATURE' | 'INVALID_SIGNATURE' | 'TIMESTAMP_EXPIRED' | 'MISSING_TOKEN' | 'INVALID_TOKEN' | 'PLATFORM_NOT_SUPPORTED' | 'NORMALIZATION_ERROR' | 'VERIFICATION_ERROR';
@@ -101,6 +104,7 @@ export interface WebhookVerificationResult<TPayload = unknown> {
     errorCode?: WebhookErrorCode;
     platform: WebhookPlatform;
     payload?: TPayload;
+    eventId?: string;
     metadata?: {
         timestamp?: string;
         id?: string | null;

package/dist/types.js

@@ -10,16 +10,18 @@ var WebhookPlatformKeys;
     WebhookPlatformKeys["Shopify"] = "shopify";
     WebhookPlatformKeys["Vercel"] = "vercel";
     WebhookPlatformKeys["Polar"] = "polar";
-    WebhookPlatformKeys["Supabase"] = "supabase";
     WebhookPlatformKeys["GitLab"] = "gitlab";
     WebhookPlatformKeys["Paddle"] = "paddle";
     WebhookPlatformKeys["Razorpay"] = "razorpay";
     WebhookPlatformKeys["LemonSqueezy"] = "lemonsqueezy";
-    WebhookPlatformKeys["Auth0"] = "auth0";
     WebhookPlatformKeys["WorkOS"] = "workos";
     WebhookPlatformKeys["WooCommerce"] = "woocommerce";
     WebhookPlatformKeys["ReplicateAI"] = "replicateai";
     WebhookPlatformKeys["FalAI"] = "falai";
+    WebhookPlatformKeys["Sentry"] = "sentry";
+    WebhookPlatformKeys["Grafana"] = "grafana";
+    WebhookPlatformKeys["Doppler"] = "doppler";
+    WebhookPlatformKeys["Sanity"] = "sanity";
     WebhookPlatformKeys["Custom"] = "custom";
     WebhookPlatformKeys["Unknown"] = "unknown";
 })(WebhookPlatformKeys || (exports.WebhookPlatformKeys = WebhookPlatformKeys = {}));

package/dist/utils.js

@@ -131,9 +131,6 @@ function detectPlatformFromHeaders(headers) {
     if (headerMap.has('x-signature')) {
         return 'lemonsqueezy';
     }
-    if (headerMap.has('x-auth0-signature')) {
-        return 'auth0';
-    }
     if (headerMap.has('x-wc-webhook-signature')) {
         return 'woocommerce';
     }
@@ -158,10 +155,6 @@ function detectPlatformFromHeaders(headers) {
             return 'polar';
         }
     }
-    // Supabase
-    if (headerMap.has('x-webhook-token')) {
-        return 'supabase';
-    }
     return null;
 }
 /**

package/dist/verifiers/algorithms.d.ts

@@ -17,6 +17,7 @@ export declare abstract class AlgorithmBasedVerifier extends WebhookVerifier {
     protected extractMetadata(request: Request): Record<string, any>;
 }
 export declare class GenericHMACVerifier extends AlgorithmBasedVerifier {
+    private resolveSentryPayloadCandidates;
     verify(request: Request): Promise<WebhookVerificationResult>;
 }
 export declare class Ed25519Verifier extends AlgorithmBasedVerifier {

package/dist/verifiers/algorithms.js

@@ -93,6 +93,13 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
                     this.extractTimestamp(request);
                 return timestamp ? `${timestamp}.${rawBody}` : rawBody;
             }
+            case "json-stringified":
+                try {
+                    return JSON.stringify(JSON.parse(rawBody));
+                }
+                catch {
+                    return rawBody;
+                }
             case "custom":
                 return this.formatCustomPayload(rawBody, request);
             case "raw":
@@ -107,10 +114,18 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
         const customFormat = this.config.customConfig.payloadFormat;
         if (customFormat.includes("{id}") && customFormat.includes("{timestamp}")) {
             const id = request.headers.get(this.config.customConfig.idHeader || "x-webhook-id");
-            const timestamp = request.headers.get(this.config.timestampHeader || "x-webhook-timestamp");
+            const timestamp = request.headers.get(this.config.timestampHeader ||
+                this.config.customConfig?.timestampHeader ||
+                "x-webhook-timestamp");
+            // if either is missing payload will be malformed — fail explicitly
+            if (!id || !timestamp) {
+                throw new Error(`Missing required headers for payload construction: ${!id ? this.config.customConfig.idHeader || "x-webhook-id" : ""} ${!timestamp
+                    ? this.config.timestampHeader || "x-webhook-timestamp"
+                    : ""}`.trim());
+            }
             return customFormat
-                .replace("{id}", id || "")
-                .replace("{timestamp}", timestamp || "")
+                .replace("{id}", id.trim() || "")
+                .replace("{timestamp}", timestamp.trim() || "")
                 .replace("{body}", rawBody);
         }
         if (customFormat.includes("{timestamp}") &&
@@ -178,9 +193,16 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
                 metadata.id = request.headers.get(this.config.customConfig?.idHeader || "webhook-id");
                 break;
             case "workos":
-                metadata.id = request.headers.get(this.config.customConfig?.idHeader || "webhook-id");
+            case "sentry":
+            case "sanity":
+                metadata.id = request.headers.get(this.config.idHeader ||
+                    this.config.customConfig?.idHeader ||
+                    "webhook-id");
                 break;
             default:
+                if (this.config.idHeader) {
+                    metadata.id = request.headers.get(this.config.idHeader);
+                }
                 break;
         }
         return metadata;
@@ -188,6 +210,33 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
 }
 exports.AlgorithmBasedVerifier = AlgorithmBasedVerifier;
 class GenericHMACVerifier extends AlgorithmBasedVerifier {
+    resolveSentryPayloadCandidates(rawBody, request) {
+        const candidates = [
+            this.formatPayload(rawBody, request),
+            rawBody,
+        ];
+        if (this.config.payloadFormat === "json-stringified") {
+            try {
+                const parsed = JSON.parse(rawBody);
+                candidates.push(JSON.stringify(parsed));
+                const issueAlertPath = this.config.customConfig?.issueAlertPayloadPath;
+                if (issueAlertPath) {
+                    const segments = `${issueAlertPath}`.split(".").filter(Boolean);
+                    let current = parsed;
+                    for (const segment of segments) {
+                        current = current?.[segment];
+                    }
+                    if (current !== undefined) {
+                        candidates.push(typeof current === "string" ? current : JSON.stringify(current));
+                    }
+                }
+            }
+            catch {
+                // ignore malformed JSON payloads
+            }
+        }
+        return [...new Set(candidates.filter(Boolean))];
+    }
     async verify(request) {
         try {
             const signature = this.extractSignature(request);
@@ -215,17 +264,24 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
                     platform: this.platform,
                 };
             }
-            const payload = this.formatPayload(rawBody, request);
+            const payloadCandidates = this.platform === "sentry"
+                ? this.resolveSentryPayloadCandidates(rawBody, request)
+                : [this.formatPayload(rawBody, request)];
             let isValid = false;
             const algorithm = this.config.algorithm.replace("hmac-", "");
-            if (this.config.customConfig?.encoding === "base64") {
-                isValid = this.verifyHMACWithBase64(payload, signature, algorithm);
-            }
-            else if (this.config.headerFormat === "prefixed") {
-                isValid = this.verifyHMACWithPrefix(payload, signature, algorithm);
-            }
-            else {
-                isValid = this.verifyHMAC(payload, signature, algorithm);
+            for (const payload of payloadCandidates) {
+                if (this.config.customConfig?.encoding === "base64") {
+                    isValid = this.verifyHMACWithBase64(payload, signature, algorithm);
+                }
+                else if (this.config.headerFormat === "prefixed") {
+                    isValid = this.verifyHMACWithPrefix(payload, signature, algorithm);
+                }
+                else {
+                    isValid = this.verifyHMAC(payload, signature, algorithm);
+                }
+                if (isValid) {
+                    break;
+                }
             }
             if (!isValid) {
                 return {
@@ -242,11 +298,18 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
             catch (e) {
                 parsedPayload = rawBody;
             }
+            const metadata = this.extractMetadata(request);
+            if (this.platform === "doppler" && !metadata.id) {
+                const timestamp = metadata.timestamp || Math.floor(Date.now() / 1000).toString();
+                metadata.id = (0, crypto_1.createHash)("sha256")
+                    .update(`${timestamp}:${rawBody}`)
+                    .digest("hex");
+            }
             return {
                 isValid: true,
                 platform: this.platform,
                 payload: parsedPayload,
-                metadata: this.extractMetadata(request),
+                metadata,
             };
         }
         catch (error) {

package/dist/verifiers/base.d.ts

@@ -1,4 +1,4 @@
-import { WebhookVerificationResult } from "../types";
+import { WebhookVerificationResult } from '../types';
 export declare abstract class WebhookVerifier {
     protected secret: string;
     protected toleranceInSeconds: number;

package/dist/verifiers/custom-algorithms.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.TokenBasedVerifier = void 0;
 exports.createCustomVerifier = createCustomVerifier;
 const base_1 = require("./base");
-// Token-based verifier for platforms like Supabase
+// Token-based verifier for providers that use header token authentication
 class TokenBasedVerifier extends base_1.WebhookVerifier {
     constructor(secret, config, toleranceInSeconds = 300) {
         super(secret, toleranceInSeconds);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hookflo/tern",
-  "version": "2.2.10",
+  "version": "3.0.1",
   "description": "A robust, scalable webhook verification framework supporting multiple platforms and signature algorithms",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",