@hookflo/tern 3.0.0 → 3.0.2

package/dist/verifiers/algorithms.d.ts

@@ -6,7 +6,7 @@ export declare abstract class AlgorithmBasedVerifier extends WebhookVerifier {
     constructor(secret: string, config: SignatureConfig, platform: WebhookPlatform, toleranceInSeconds?: number);
     abstract verify(request: Request): Promise<WebhookVerificationResult>;
     protected parseDelimitedHeader(headerValue: string): Record<string, string>;
-    protected extractSignature(request: Request): string | null;
+    protected extractSignatures(request: Request): string[];
     protected extractTimestamp(request: Request): number | null;
     protected extractTimestampFromSignature(request: Request): number | null;
     protected formatPayload(rawBody: string, request: Request): string;

package/dist/verifiers/algorithms.js

@@ -31,31 +31,51 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
         }
         return values;
     }
-    extractSignature(request) {
+    extractSignatures(request) {
         const headerValue = request.headers.get(this.config.headerName);
         if (!headerValue)
-            return null;
+            return [];
         switch (this.config.headerFormat) {
             case "prefixed":
-                return headerValue.trim();
+                return [headerValue.trim()].filter(Boolean);
             case "comma-separated": {
                 const sigMap = this.parseDelimitedHeader(headerValue);
                 const signatureKey = this.config.customConfig?.signatureKey || "v1";
-                return sigMap[signatureKey] || sigMap.signature || sigMap.v1 || null;
+                return [
+                    sigMap[signatureKey],
+                    sigMap.signature,
+                    sigMap.v1,
+                ].filter((value) => Boolean(value));
             }
             case "raw":
             default:
                 if (this.config.customConfig?.signatureFormat?.includes("v1=")) {
-                    const signatures = headerValue.split(" ");
+                    const signatures = headerValue
+                        .trim()
+                        .split(/\s+/)
+                        .map((entry) => entry.trim())
+                        .filter(Boolean);
+                    const normalized = [];
                     for (const sig of signatures) {
-                        const [version, signature] = sig.split(",");
-                        if (version === "v1") {
-                            return signature;
+                        // Standard Webhooks format is usually "v1,<signature>"
+                        if (sig.startsWith("v1,")) {
+                            const [, value] = sig.split(",", 2);
+                            if (value) {
+                                normalized.push(value.trim());
+                            }
+                            continue;
+                        }
+                        // Accept "v1=<signature>" variants used by some providers/docs.
+                        if (sig.startsWith("v1=")) {
+                            const [, value] = sig.split("=", 2);
+                            if (value) {
+                                normalized.push(value.trim());
+                            }
                         }
                     }
-                    return null;
+                    return normalized;
                 }
-                return headerValue;
+                return [headerValue.trim()].filter(Boolean);
         }
     }
     extractTimestamp(request) {
@@ -114,10 +134,18 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
         const customFormat = this.config.customConfig.payloadFormat;
         if (customFormat.includes("{id}") && customFormat.includes("{timestamp}")) {
             const id = request.headers.get(this.config.customConfig.idHeader || "x-webhook-id");
-            const timestamp = request.headers.get(this.config.timestampHeader || "x-webhook-timestamp");
+            const timestamp = request.headers.get(this.config.timestampHeader ||
+                this.config.customConfig?.timestampHeader ||
+                "x-webhook-timestamp");
+            // if either is missing payload will be malformed — fail explicitly
+            if (!id || !timestamp) {
+                throw new Error(`Missing required headers for payload construction: ${!id ? this.config.customConfig.idHeader || "x-webhook-id" : ""} ${!timestamp
+                    ? this.config.timestampHeader || "x-webhook-timestamp"
+                    : ""}`.trim());
+            }
             return customFormat
-                .replace("{id}", id || "")
-                .replace("{timestamp}", timestamp || "")
+                .replace("{id}", id.trim() || "")
+                .replace("{timestamp}", timestamp.trim() || "")
                 .replace("{body}", rawBody);
         }
         if (customFormat.includes("{timestamp}") &&
@@ -187,7 +215,9 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
             case "workos":
             case "sentry":
             case "sanity":
-                metadata.id = request.headers.get(this.config.idHeader || this.config.customConfig?.idHeader || "webhook-id");
+                metadata.id = request.headers.get(this.config.idHeader ||
+                    this.config.customConfig?.idHeader ||
+                    "webhook-id");
                 break;
             default:
                 if (this.config.idHeader) {
@@ -201,7 +231,10 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
 exports.AlgorithmBasedVerifier = AlgorithmBasedVerifier;
 class GenericHMACVerifier extends AlgorithmBasedVerifier {
     resolveSentryPayloadCandidates(rawBody, request) {
-        const candidates = [this.formatPayload(rawBody, request), rawBody];
+        const candidates = [
+            this.formatPayload(rawBody, request),
+            rawBody,
+        ];
         if (this.config.payloadFormat === "json-stringified") {
             try {
                 const parsed = JSON.parse(rawBody);
@@ -226,8 +259,8 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
     }
     async verify(request) {
         try {
-            const signature = this.extractSignature(request);
-            if (!signature) {
+            const signatures = this.extractSignatures(request);
+            if (signatures.length === 0) {
                 return {
                     isValid: false,
                     error: `Missing signature header: ${this.config.headerName}`,
@@ -257,14 +290,19 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
             let isValid = false;
             const algorithm = this.config.algorithm.replace("hmac-", "");
             for (const payload of payloadCandidates) {
-                if (this.config.customConfig?.encoding === "base64") {
-                    isValid = this.verifyHMACWithBase64(payload, signature, algorithm);
-                }
-                else if (this.config.headerFormat === "prefixed") {
-                    isValid = this.verifyHMACWithPrefix(payload, signature, algorithm);
-                }
-                else {
-                    isValid = this.verifyHMAC(payload, signature, algorithm);
+                for (const signature of signatures) {
+                    if (this.config.customConfig?.encoding === "base64") {
+                        isValid = this.verifyHMACWithBase64(payload, signature, algorithm);
+                    }
+                    else if (this.config.headerFormat === "prefixed") {
+                        isValid = this.verifyHMACWithPrefix(payload, signature, algorithm);
+                    }
+                    else {
+                        isValid = this.verifyHMAC(payload, signature, algorithm);
+                    }
+                    if (isValid) {
+                        break;
+                    }
                 }
                 if (isValid) {
                     break;
@@ -399,8 +437,8 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
     }
     async verify(request) {
         try {
-            const signature = this.extractSignature(request);
-            if (!signature) {
+            const signatures = this.extractSignatures(request);
+            if (signatures.length === 0) {
                 return {
                     isValid: false,
                     error: `Missing signature header: ${this.config.headerName}`,
@@ -453,23 +491,28 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
             // fal.ai signature is hex encoded (not base64)
             // other ED25519 platforms use base64 by default
             const signatureEncoding = this.platform === "falai" ? "hex" : "base64";
-            const signatureBytes = new Uint8Array(Buffer.from(signature, signatureEncoding));
             const payloadBytes = new Uint8Array(Buffer.from(payload, "utf-8"));
             // try all keys — succeeds if any key validates
             // this handles key rotation gracefully
             let isValid = false;
-            for (const pem of publicKeys) {
-                try {
-                    const keyObject = (0, crypto_1.createPublicKey)(pem);
-                    const valid = (0, crypto_1.verify)(null, payloadBytes, keyObject, signatureBytes);
-                    if (valid) {
-                        isValid = true;
-                        break;
+            for (const signature of signatures) {
+                const signatureBytes = new Uint8Array(Buffer.from(signature, signatureEncoding));
+                for (const pem of publicKeys) {
+                    try {
+                        const keyObject = (0, crypto_1.createPublicKey)(pem);
+                        const valid = (0, crypto_1.verify)(null, payloadBytes, keyObject, signatureBytes);
+                        if (valid) {
+                            isValid = true;
+                            break;
+                        }
+                    }
+                    catch {
+                        // this key failed — try next
+                        continue;
                     }
                 }
-                catch {
-                    // this key failed — try next
-                    continue;
+                if (isValid) {
+                    break;
                 }
             }
             if (!isValid) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hookflo/tern",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "description": "A robust, scalable webhook verification framework supporting multiple platforms and signature algorithms",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",