@hookflo/tern 3.0.0 → 3.0.1

package/dist/verifiers/algorithms.js

@@ -114,10 +114,18 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
         const customFormat = this.config.customConfig.payloadFormat;
         if (customFormat.includes("{id}") && customFormat.includes("{timestamp}")) {
             const id = request.headers.get(this.config.customConfig.idHeader || "x-webhook-id");
-            const timestamp = request.headers.get(this.config.timestampHeader || "x-webhook-timestamp");
+            const timestamp = request.headers.get(this.config.timestampHeader ||
+                this.config.customConfig?.timestampHeader ||
+                "x-webhook-timestamp");
+            // if either is missing payload will be malformed — fail explicitly
+            if (!id || !timestamp) {
+                throw new Error(`Missing required headers for payload construction: ${!id ? this.config.customConfig.idHeader || "x-webhook-id" : ""} ${!timestamp
+                    ? this.config.timestampHeader || "x-webhook-timestamp"
+                    : ""}`.trim());
+            }
             return customFormat
-                .replace("{id}", id || "")
-                .replace("{timestamp}", timestamp || "")
+                .replace("{id}", id.trim() || "")
+                .replace("{timestamp}", timestamp.trim() || "")
                 .replace("{body}", rawBody);
         }
         if (customFormat.includes("{timestamp}") &&
@@ -187,7 +195,9 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
             case "workos":
             case "sentry":
             case "sanity":
-                metadata.id = request.headers.get(this.config.idHeader || this.config.customConfig?.idHeader || "webhook-id");
+                metadata.id = request.headers.get(this.config.idHeader ||
+                    this.config.customConfig?.idHeader ||
+                    "webhook-id");
                 break;
             default:
                 if (this.config.idHeader) {
@@ -201,7 +211,10 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
 exports.AlgorithmBasedVerifier = AlgorithmBasedVerifier;
 class GenericHMACVerifier extends AlgorithmBasedVerifier {
     resolveSentryPayloadCandidates(rawBody, request) {
-        const candidates = [this.formatPayload(rawBody, request), rawBody];
+        const candidates = [
+            this.formatPayload(rawBody, request),
+            rawBody,
+        ];
         if (this.config.payloadFormat === "json-stringified") {
             try {
                 const parsed = JSON.parse(rawBody);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hookflo/tern",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "A robust, scalable webhook verification framework supporting multiple platforms and signature algorithms",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",