@hookflo/tern 2.2.9 → 2.2.10

package/dist/adapters/express.d.ts

@@ -1,5 +1,5 @@
-import { WebhookPlatform, WebhookVerificationResult, NormalizeOptions } from '../types';
-import { MinimalNodeRequest } from './shared';
+import { WebhookPlatform, WebhookVerificationResult, NormalizeOptions } from "../types";
+import { MinimalNodeRequest } from "./shared";
 export interface ExpressLikeResponse {
     status: (code: number) => ExpressLikeResponse;
     json: (payload: unknown) => unknown;
@@ -7,7 +7,7 @@ export interface ExpressLikeResponse {
 export interface ExpressLikeRequest extends MinimalNodeRequest {
     webhook?: WebhookVerificationResult;
 }
-export type ExpressLikeNext = () => void;
+export type ExpressLikeNext = (err?: unknown) => void;
 export interface ExpressWebhookMiddlewareOptions {
     platform: WebhookPlatform;
     secret: string;

package/dist/adapters/express.js

@@ -9,7 +9,12 @@ function createWebhookMiddleware(options) {
             const webRequest = await (0, shared_1.toWebRequest)(req);
             const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(webRequest, options.platform, options.secret, options.toleranceInSeconds, options.normalize);
             if (!result.isValid) {
-                res.status(400).json({ error: result.error, errorCode: result.errorCode, platform: result.platform, metadata: result.metadata });
+                res.status(400).json({
+                    error: result.error,
+                    errorCode: result.errorCode,
+                    platform: result.platform,
+                    metadata: result.metadata,
+                });
                 return;
             }
             req.webhook = result;
@@ -17,7 +22,7 @@ function createWebhookMiddleware(options) {
         }
         catch (error) {
             options.onError?.(error);
-            res.status(500).json({ error: error.message });
+            next(error);
         }
     };
 }

package/dist/adapters/shared.d.ts

@@ -6,8 +6,8 @@ export interface MinimalNodeRequest {
     get?: (name: string) => string | undefined;
     originalUrl?: string;
     url?: string;
-    on?: (event: string, cb: (chunk?: any) => void) => void;
+    on?: (event: string, cb: (chunk?: unknown) => void) => void;
 }
-export declare function extractRawBody(request: MinimalNodeRequest): Promise<string>;
+export declare function extractRawBody(request: MinimalNodeRequest): Promise<Uint8Array>;
 export declare function toHeadersInit(headers: Record<string, string | string[] | undefined>): HeadersInit;
 export declare function toWebRequest(request: MinimalNodeRequest): Promise<Request>;

package/dist/adapters/shared.js

@@ -6,39 +6,65 @@ exports.toWebRequest = toWebRequest;
 function getHeaderValue(headers, name) {
     const value = headers[name.toLowerCase()] ?? headers[name];
     if (Array.isArray(value)) {
-        return value.join(',');
+        return value.join(",");
     }
     return value;
 }
-async function readIncomingMessageBody(request) {
-    if (!request.on) {
-        return '';
-    }
+async function readIncomingMessageBodyAsBuffer(request) {
+    if (!request.on)
+        return new Uint8Array(0);
     const chunks = [];
     return new Promise((resolve, reject) => {
-        request.on?.('data', (chunk) => {
-            if (typeof chunk === 'string') {
+        request.on?.("data", (chunk) => {
+            if (chunk instanceof Uint8Array) {
                 chunks.push(chunk);
-                return;
             }
-            chunks.push(Buffer.from(chunk ?? '').toString('utf8'));
+            else if (typeof chunk === "string") {
+                chunks.push(new TextEncoder().encode(chunk));
+            }
+            else if (chunk != null) {
+                try {
+                    chunks.push(new TextEncoder().encode(String(chunk)));
+                }
+                catch {
+                    // skip unreadable chunk silently
+                }
+            }
         });
-        request.on?.('end', () => resolve(chunks.join('')));
-        request.on?.('error', reject);
+        request.on?.("end", () => {
+            const totalLength = chunks.reduce((sum, c) => sum + c.byteLength, 0);
+            const result = new Uint8Array(totalLength);
+            let offset = 0;
+            for (const chunk of chunks) {
+                result.set(chunk, offset);
+                offset += chunk.byteLength;
+            }
+            resolve(result);
+        });
+        request.on?.("error", (err) => reject(err));
     });
 }
 async function extractRawBody(request) {
     const body = request.body;
-    if (typeof body === 'string') {
+    if (body instanceof Uint8Array) {
         return body;
     }
-    if (Buffer.isBuffer(body)) {
-        return body.toString('utf8');
+    if (typeof body === "string") {
+        return new TextEncoder().encode(body);
     }
-    if (body && typeof body === 'object') {
-        return JSON.stringify(body);
+    if (body !== null && body !== undefined && typeof body === "object") {
+        console.warn("[Tern] Warning: request body is already parsed as JSON. " +
+            "Signature verification may fail. " +
+            'Add express.raw({ type: "*/*" }) before Tern on webhook routes, ' +
+            "or register webhook routes before app.use(express.json()).");
+        return new TextEncoder().encode(JSON.stringify(body));
     }
-    return readIncomingMessageBody(request);
+    // nothing ran — read raw stream directly
+    return readIncomingMessageBodyAsBuffer(request);
+}
+// converts Uint8Array to a plain ArrayBuffer that all TS versions accept as BodyInit
+function toArrayBuffer(uint8) {
+    return uint8.buffer.slice(uint8.byteOffset, uint8.byteOffset + uint8.byteLength);
 }
 function toHeadersInit(headers) {
     const normalized = new Headers();
@@ -47,7 +73,7 @@ function toHeadersInit(headers) {
             continue;
         }
         if (Array.isArray(value)) {
-            normalized.set(key, value.join(','));
+            normalized.set(key, value.join(","));
             continue;
         }
         normalized.set(key, value);
@@ -55,13 +81,17 @@ function toHeadersInit(headers) {
     return normalized;
 }
 async function toWebRequest(request) {
-    const protocol = request.protocol || 'https';
-    const host = request.get?.('host') || getHeaderValue(request.headers, 'host') || 'localhost';
-    const path = request.originalUrl || request.url || '/';
+    const protocol = request.protocol || "https";
+    const host = request.get?.("host") ||
+        getHeaderValue(request.headers, "host") ||
+        "localhost";
+    const path = request.originalUrl || request.url || "/";
     const rawBody = await extractRawBody(request);
-    return new Request(`${protocol}://${host}${path}`, {
-        method: request.method || 'POST',
+    const init = {
+        method: request.method || "POST",
         headers: toHeadersInit(request.headers),
-        body: rawBody,
-    });
+        body: toArrayBuffer(rawBody),
+        duplex: "half",
+    };
+    return new Request(`${protocol}://${host}${path}`, init);
 }

package/dist/adapters/testExpress.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/adapters/testExpress.js

@@ -0,0 +1,84 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = __importDefault(require("crypto"));
+const shared_1 = require("./shared");
+const __1 = __importDefault(require(".."));
+const secret = "whsec_test_secret";
+const payload = JSON.stringify({ type: "payment_intent.succeeded", data: { amount: 2000 } }) +
+    "\n";
+function buildStripeSignature(body, secret) {
+    const timestamp = Math.floor(Date.now() / 1000);
+    const signed = `${timestamp}.${body}`;
+    const hmac = crypto_1.default
+        .createHmac("sha256", secret.replace("whsec_", ""))
+        .update(signed)
+        .digest("hex");
+    return `t=${timestamp},v1=${hmac}`;
+}
+// ── Test 1: raw stream — no middleware ran ───────────────────
+async function testRawStream() {
+    const sig = buildStripeSignature(payload, secret); // ✓ fixed: was missing secret arg
+    const chunks = [Buffer.from(payload, "utf8")];
+    const req = {
+        method: "POST",
+        headers: {
+            "stripe-signature": sig,
+            "content-type": "application/json",
+        },
+        body: undefined,
+        on: (event, cb) => {
+            if (event === "data") {
+                for (const chunk of chunks)
+                    cb(chunk);
+            }
+            if (event === "end") {
+                cb();
+            }
+        },
+    };
+    const webReq = await (0, shared_1.toWebRequest)(req);
+    const result = await __1.default.verifyWithPlatformConfig(webReq, "stripe", secret);
+    console.log("Test 1 Raw stream (no middleware):", result.isValid ? "✓ PASS" : `✗ FAIL — ${result.error}`);
+}
+// ── Test 2: Buffer body — express.raw() ran ──────────────────
+async function testBufferBody() {
+    const sig = buildStripeSignature(payload, secret);
+    const req = {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "stripe-signature": sig,
+        },
+        body: Buffer.from(payload, "utf8"),
+    };
+    const webReq = await (0, shared_1.toWebRequest)(req);
+    const result = await __1.default.verifyWithPlatformConfig(webReq, "stripe", secret);
+    console.log("Test 2 Buffer body (express.raw):", result.isValid ? "✓ PASS" : `✗ FAIL — ${result.error}`);
+}
+// ── Test 3: parsed object — express.json() ran ───────────────
+async function testParsedObject() {
+    // signature computed against raw payload including \n
+    const sig = buildStripeSignature(payload, secret);
+    const req = {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "stripe-signature": sig,
+        },
+        body: JSON.parse(payload), // \n gone, bytes lost
+    };
+    const webReq = await (0, shared_1.toWebRequest)(req);
+    const result = await __1.default.verifyWithPlatformConfig(webReq, "stripe", secret);
+    // should FAIL — \n was in original signature but lost after JSON.parse
+    console.log("Test 3 Parsed object (express.json):", !result.isValid ? "✓ FAILS AS EXPECTED" : "✗ SHOULD HAVE FAILED");
+}
+async function run() {
+    await testRawStream(); // no middleware      → should PASS
+    await testBufferBody(); // express.raw()      → should PASS
+    await testParsedObject(); // express.json()     → should FAIL as expected
+    console.log("\nDone. Test 3 failing is correct behavior.");
+}
+run();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hookflo/tern",
-  "version": "2.2.9",
+  "version": "2.2.10",
   "description": "A robust, scalable webhook verification framework supporting multiple platforms and signature algorithms",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",