@hookflo/tern 3.0.2 → 3.0.3

package/dist/platforms/algorithms.js

@@ -109,7 +109,7 @@ exports.platformAlgorithmConfigs = {
                 signatureFormat: 'v1={signature}',
                 payloadFormat: '{id}.{timestamp}.{body}',
                 encoding: 'base64',
-                secretEncoding: 'base64',
+                secretEncoding: 'utf8',
                 idHeader: 'webhook-id',
             },
         },

package/dist/verifiers/algorithms.js

@@ -41,11 +41,7 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
             case "comma-separated": {
                 const sigMap = this.parseDelimitedHeader(headerValue);
                 const signatureKey = this.config.customConfig?.signatureKey || "v1";
-                return [
-                    sigMap[signatureKey],
-                    sigMap.signature,
-                    sigMap.v1,
-                ].filter((value) => Boolean(value));
+                return [sigMap[signatureKey], sigMap.signature, sigMap.v1].filter((value) => Boolean(value));
             }
             case "raw":
             default:
@@ -174,12 +170,13 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
         const secretEncoding = this.config.customConfig?.secretEncoding || "base64";
         let secretMaterial = this.secret;
         if (secretEncoding === "base64") {
-            const base64Secret = this.secret.includes("_")
-                ? this.secret.split("_").slice(1).join("_")
-                : this.secret;
-            secretMaterial = new Uint8Array(Buffer.from(base64Secret, "base64"));
+            let rawSecret = this.secret;
+            const lastUnderscore = rawSecret.lastIndexOf("_");
+            if (lastUnderscore !== -1) {
+                rawSecret = rawSecret.slice(lastUnderscore + 1);
+            }
+            secretMaterial = new Uint8Array(Buffer.from(rawSecret, "base64"));
         }
-        // 'utf8', 'raw', or anything else → use secret as-is
         const hmac = (0, crypto_1.createHmac)(algorithm, secretMaterial);
         hmac.update(payload);
         const expectedSignature = hmac.digest("base64");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hookflo/tern",
-  "version": "3.0.2",
+  "version": "3.0.3",
   "description": "A robust, scalable webhook verification framework supporting multiple platforms and signature algorithms",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",