@isnap/sdk 0.1.0 → 1.1.0-next.38

package/dist/webhook-verify.d.ts

@@ -1,27 +0,0 @@
-/**
- * Verify an incoming webhook signature.
- *
- * Checks that the HMAC-SHA256 signature matches and the timestamp is within
- * the 5-minute replay window.
- *
- * @param secret - The webhook secret (from {@link Webhook.secret})
- * @param signature - The `x-isnap-signature` header value
- * @param timestamp - The `x-isnap-timestamp` header value (Unix seconds)
- * @param payload - The raw request body string
- * @returns `true` if the signature is valid and the timestamp is fresh
- *
- * @example
- * ```ts
- * import { verifyWebhookSignature } from '@isnap/sdk';
- *
- * const valid = verifyWebhookSignature(
- *   webhookSecret,
- *   req.headers['x-isnap-signature'],
- *   req.headers['x-isnap-timestamp'],
- *   req.body,
- * );
- * if (!valid) return res.status(401).send('Invalid signature');
- * ```
- */
-export declare function verifyWebhookSignature(secret: string, signature: string, timestamp: string, payload: string): boolean;
-//# sourceMappingURL=webhook-verify.d.ts.map

package/dist/webhook-verify.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"webhook-verify.d.ts","sourceRoot":"","sources":["../src/webhook-verify.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAcT"}

package/dist/webhook-verify.js

@@ -1,42 +0,0 @@
-import { createHmac, timingSafeEqual } from 'node:crypto';
-/**
- * Verify an incoming webhook signature.
- *
- * Checks that the HMAC-SHA256 signature matches and the timestamp is within
- * the 5-minute replay window.
- *
- * @param secret - The webhook secret (from {@link Webhook.secret})
- * @param signature - The `x-isnap-signature` header value
- * @param timestamp - The `x-isnap-timestamp` header value (Unix seconds)
- * @param payload - The raw request body string
- * @returns `true` if the signature is valid and the timestamp is fresh
- *
- * @example
- * ```ts
- * import { verifyWebhookSignature } from '@isnap/sdk';
- *
- * const valid = verifyWebhookSignature(
- *   webhookSecret,
- *   req.headers['x-isnap-signature'],
- *   req.headers['x-isnap-timestamp'],
- *   req.body,
- * );
- * if (!valid) return res.status(401).send('Invalid signature');
- * ```
- */
-export function verifyWebhookSignature(secret, signature, timestamp, payload) {
-    // Reject if timestamp is too old (5 minutes)
-    const ts = parseInt(timestamp, 10);
-    const age = Math.abs(Date.now() / 1000 - ts);
-    if (age > 300)
-        return false;
-    const data = `${ts}.${payload}`;
-    const expected = createHmac('sha256', secret).update(data).digest('hex');
-    try {
-        return timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
-    }
-    catch {
-        return false;
-    }
-}
-//# sourceMappingURL=webhook-verify.js.map

package/dist/webhook-verify.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"webhook-verify.js","sourceRoot":"","sources":["../src/webhook-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,SAAiB,EACjB,SAAiB,EACjB,OAAe;IAEf,6CAA6C;IAC7C,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;IAC7C,IAAI,GAAG,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEzE,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}