@hookflo/tern 3.0.1 → 3.0.3

package/dist/platforms/algorithms.js

@@ -109,7 +109,7 @@ exports.platformAlgorithmConfigs = {
                 signatureFormat: 'v1={signature}',
                 payloadFormat: '{id}.{timestamp}.{body}',
                 encoding: 'base64',
-                secretEncoding: 'base64',
+                secretEncoding: 'utf8',
                 idHeader: 'webhook-id',
             },
         },

package/dist/verifiers/algorithms.d.ts

@@ -6,7 +6,7 @@ export declare abstract class AlgorithmBasedVerifier extends WebhookVerifier {
     constructor(secret: string, config: SignatureConfig, platform: WebhookPlatform, toleranceInSeconds?: number);
     abstract verify(request: Request): Promise<WebhookVerificationResult>;
     protected parseDelimitedHeader(headerValue: string): Record<string, string>;
-    protected extractSignature(request: Request): string | null;
+    protected extractSignatures(request: Request): string[];
     protected extractTimestamp(request: Request): number | null;
     protected extractTimestampFromSignature(request: Request): number | null;
     protected formatPayload(rawBody: string, request: Request): string;

package/dist/verifiers/algorithms.js

@@ -31,31 +31,47 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
         }
         return values;
     }
-    extractSignature(request) {
+    extractSignatures(request) {
         const headerValue = request.headers.get(this.config.headerName);
         if (!headerValue)
-            return null;
+            return [];
         switch (this.config.headerFormat) {
             case "prefixed":
-                return headerValue.trim();
+                return [headerValue.trim()].filter(Boolean);
             case "comma-separated": {
                 const sigMap = this.parseDelimitedHeader(headerValue);
                 const signatureKey = this.config.customConfig?.signatureKey || "v1";
-                return sigMap[signatureKey] || sigMap.signature || sigMap.v1 || null;
+                return [sigMap[signatureKey], sigMap.signature, sigMap.v1].filter((value) => Boolean(value));
             }
             case "raw":
             default:
                 if (this.config.customConfig?.signatureFormat?.includes("v1=")) {
-                    const signatures = headerValue.split(" ");
+                    const signatures = headerValue
+                        .trim()
+                        .split(/\s+/)
+                        .map((entry) => entry.trim())
+                        .filter(Boolean);
+                    const normalized = [];
                     for (const sig of signatures) {
-                        const [version, signature] = sig.split(",");
-                        if (version === "v1") {
-                            return signature;
+                        // Standard Webhooks format is usually "v1,<signature>"
+                        if (sig.startsWith("v1,")) {
+                            const [, value] = sig.split(",", 2);
+                            if (value) {
+                                normalized.push(value.trim());
+                            }
+                            continue;
+                        }
+                        // Accept "v1=<signature>" variants used by some providers/docs.
+                        if (sig.startsWith("v1=")) {
+                            const [, value] = sig.split("=", 2);
+                            if (value) {
+                                normalized.push(value.trim());
+                            }
                         }
                     }
-                    return null;
+                    return normalized;
                 }
-                return headerValue;
+                return [headerValue.trim()].filter(Boolean);
         }
     }
     extractTimestamp(request) {
@@ -154,12 +170,13 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
         const secretEncoding = this.config.customConfig?.secretEncoding || "base64";
         let secretMaterial = this.secret;
         if (secretEncoding === "base64") {
-            const base64Secret = this.secret.includes("_")
-                ? this.secret.split("_").slice(1).join("_")
-                : this.secret;
-            secretMaterial = new Uint8Array(Buffer.from(base64Secret, "base64"));
+            let rawSecret = this.secret;
+            const lastUnderscore = rawSecret.lastIndexOf("_");
+            if (lastUnderscore !== -1) {
+                rawSecret = rawSecret.slice(lastUnderscore + 1);
+            }
+            secretMaterial = new Uint8Array(Buffer.from(rawSecret, "base64"));
         }
-        // 'utf8', 'raw', or anything else → use secret as-is
         const hmac = (0, crypto_1.createHmac)(algorithm, secretMaterial);
         hmac.update(payload);
         const expectedSignature = hmac.digest("base64");
@@ -239,8 +256,8 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
     }
     async verify(request) {
         try {
-            const signature = this.extractSignature(request);
-            if (!signature) {
+            const signatures = this.extractSignatures(request);
+            if (signatures.length === 0) {
                 return {
                     isValid: false,
                     error: `Missing signature header: ${this.config.headerName}`,
@@ -270,14 +287,19 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
             let isValid = false;
             const algorithm = this.config.algorithm.replace("hmac-", "");
             for (const payload of payloadCandidates) {
-                if (this.config.customConfig?.encoding === "base64") {
-                    isValid = this.verifyHMACWithBase64(payload, signature, algorithm);
-                }
-                else if (this.config.headerFormat === "prefixed") {
-                    isValid = this.verifyHMACWithPrefix(payload, signature, algorithm);
-                }
-                else {
-                    isValid = this.verifyHMAC(payload, signature, algorithm);
+                for (const signature of signatures) {
+                    if (this.config.customConfig?.encoding === "base64") {
+                        isValid = this.verifyHMACWithBase64(payload, signature, algorithm);
+                    }
+                    else if (this.config.headerFormat === "prefixed") {
+                        isValid = this.verifyHMACWithPrefix(payload, signature, algorithm);
+                    }
+                    else {
+                        isValid = this.verifyHMAC(payload, signature, algorithm);
+                    }
+                    if (isValid) {
+                        break;
+                    }
                 }
                 if (isValid) {
                     break;
@@ -412,8 +434,8 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
     }
     async verify(request) {
         try {
-            const signature = this.extractSignature(request);
-            if (!signature) {
+            const signatures = this.extractSignatures(request);
+            if (signatures.length === 0) {
                 return {
                     isValid: false,
                     error: `Missing signature header: ${this.config.headerName}`,
@@ -466,23 +488,28 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
             // fal.ai signature is hex encoded (not base64)
             // other ED25519 platforms use base64 by default
             const signatureEncoding = this.platform === "falai" ? "hex" : "base64";
-            const signatureBytes = new Uint8Array(Buffer.from(signature, signatureEncoding));
             const payloadBytes = new Uint8Array(Buffer.from(payload, "utf-8"));
             // try all keys — succeeds if any key validates
             // this handles key rotation gracefully
             let isValid = false;
-            for (const pem of publicKeys) {
-                try {
-                    const keyObject = (0, crypto_1.createPublicKey)(pem);
-                    const valid = (0, crypto_1.verify)(null, payloadBytes, keyObject, signatureBytes);
-                    if (valid) {
-                        isValid = true;
-                        break;
+            for (const signature of signatures) {
+                const signatureBytes = new Uint8Array(Buffer.from(signature, signatureEncoding));
+                for (const pem of publicKeys) {
+                    try {
+                        const keyObject = (0, crypto_1.createPublicKey)(pem);
+                        const valid = (0, crypto_1.verify)(null, payloadBytes, keyObject, signatureBytes);
+                        if (valid) {
+                            isValid = true;
+                            break;
+                        }
+                    }
+                    catch {
+                        // this key failed — try next
+                        continue;
                     }
                 }
-                catch {
-                    // this key failed — try next
-                    continue;
+                if (isValid) {
+                    break;
                 }
             }
             if (!isValid) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hookflo/tern",
-  "version": "3.0.1",
+  "version": "3.0.3",
   "description": "A robust, scalable webhook verification framework supporting multiple platforms and signature algorithms",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",