@nestarc/webhook 0.8.0 → 0.10.0

package/dist/webhook.signer.js

@@ -43,30 +43,44 @@ exports.WebhookSigner = void 0;
 const crypto = __importStar(require("crypto"));
 const common_1 = require("@nestjs/common");
 let WebhookSigner = class WebhookSigner {
-    sign(eventId, timestamp, body, secret) {
-        const toSign = `${eventId}.${timestamp}.${body}`;
-        const hmac = crypto
-            .createHmac('sha256', Buffer.from(secret, 'base64'))
-            .update(toSign)
-            .digest('base64');
+    signAll(eventId, timestamp, body, secrets) {
+        const signatures = secrets
+            .filter((secret) => Boolean(secret))
+            .map((secret) => this.signSingle(eventId, timestamp, body, secret));
+        if (signatures.length === 0) {
+            throw new Error('At least one signing secret is required');
+        }
         return {
             'webhook-id': eventId,
             'webhook-timestamp': String(timestamp),
-            'webhook-signature': `v1,${hmac}`,
+            'webhook-signature': signatures.join(' '),
         };
     }
+    sign(eventId, timestamp, body, secret) {
+        return this.signAll(eventId, timestamp, body, [secret]);
+    }
     verify(eventId, timestamp, body, secret, signature) {
-        const expected = this.sign(eventId, timestamp, body, secret);
-        const expectedSig = expected['webhook-signature'];
-        const a = Buffer.from(expectedSig);
-        const b = Buffer.from(signature);
-        if (a.length !== b.length)
-            return false;
-        return crypto.timingSafeEqual(a, b);
+        const expected = this.signSingle(eventId, timestamp, body, secret);
+        const providedSignatures = signature.trim().split(/\s+/).filter(Boolean);
+        return providedSignatures.some((candidate) => {
+            const a = Buffer.from(expected);
+            const b = Buffer.from(candidate);
+            if (a.length !== b.length)
+                return false;
+            return crypto.timingSafeEqual(a, b);
+        });
     }
     generateSecret() {
         return crypto.randomBytes(32).toString('base64');
     }
+    signSingle(eventId, timestamp, body, secret) {
+        const toSign = `${eventId}.${timestamp}.${body}`;
+        const hmac = crypto
+            .createHmac('sha256', Buffer.from(secret, 'base64'))
+            .update(toSign)
+            .digest('base64');
+        return `v1,${hmac}`;
+    }
 };
 exports.WebhookSigner = WebhookSigner;
 exports.WebhookSigner = WebhookSigner = __decorate([

package/dist/webhook.signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.signer.js","sourceRoot":"","sources":["../src/webhook.signer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AACjC,2CAA4C;AAUrC,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,IAAI,CACF,OAAe,EACf,SAAiB,EACjB,IAAY,EACZ,MAAc;QAEd,MAAM,MAAM,GAAG,GAAG,OAAO,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM;aAChB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;aACnD,MAAM,CAAC,MAAM,CAAC;aACd,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpB,OAAO;YACL,YAAY,EAAE,OAAO;YACrB,mBAAmB,EAAE,MAAM,CAAC,SAAS,CAAC;YACtC,mBAAmB,EAAE,MAAM,IAAI,EAAE;SAClC,CAAC;IACJ,CAAC;IAED,MAAM,CACJ,OAAe,EACf,SAAiB,EACjB,IAAY,EACZ,MAAc,EACd,SAAiB;QAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAElD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEjC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAExC,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,cAAc;QACZ,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAzCY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;GACA,aAAa,CAyCzB"}
+{"version":3,"file":"webhook.signer.js","sourceRoot":"","sources":["../src/webhook.signer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AACjC,2CAA4C;AAUrC,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,OAAO,CACL,OAAe,EACf,SAAiB,EACjB,IAAY,EACZ,OAAiB;QAEjB,MAAM,UAAU,GAAG,OAAO;aACvB,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;aACrD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAEtE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;YACL,YAAY,EAAE,OAAO;YACrB,mBAAmB,EAAE,MAAM,CAAC,SAAS,CAAC;YACtC,mBAAmB,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED,IAAI,CACF,OAAe,EACf,SAAiB,EACjB,IAAY,EACZ,MAAc;QAEd,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,CACJ,OAAe,EACf,SAAiB,EACjB,IAAY,EACZ,MAAc,EACd,SAAiB;QAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,kBAAkB,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEzE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;YAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAEjC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAExC,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,cAAc;QACZ,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IAEO,UAAU,CAChB,OAAe,EACf,SAAiB,EACjB,IAAY,EACZ,MAAc;QAEd,MAAM,MAAM,GAAG,GAAG,OAAO,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM;aAChB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;aACnD,MAAM,CAAC,MAAM,CAAC;aACd,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpB,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAA;AArEY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;GACA,aAAa,CAqEzB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestarc/webhook",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Outbound webhook delivery for NestJS — HMAC signing, exponential retry, circuit breaker, delivery logs, fan-out, Standard Webhooks compatible",
   "author": "nestarc",
   "license": "MIT",
@@ -33,9 +33,9 @@
     "@nestjs/schedule": "^5.0.0",
     "@nestjs/testing": "^11.0.0",
     "@prisma/client": "^6.0.0",
-    "@types/jest": "^29.5.0",
-    "@types/node": "^20.0.0",
-    "jest": "^29.7.0",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^25.6.0",
+    "jest": "^30.3.0",
     "prisma": "^6.19.3",
     "reflect-metadata": "^0.2.0",
     "rxjs": "^7.8.0",

package/src/sql/create-webhook-tables.sql

@@ -1,5 +1,5 @@
 -- @nestarc/webhook — PostgreSQL migration
--- Creates the three core tables for outbound webhook delivery.
+-- Creates the four core tables for outbound webhook delivery.
 -- Run this migration against your PostgreSQL database before using the module.
 
 -- Required for gen_random_uuid() on PostgreSQL < 13
@@ -9,6 +9,8 @@ CREATE TABLE IF NOT EXISTS webhook_endpoints (
   id                   UUID         PRIMARY KEY DEFAULT gen_random_uuid(),
   url                  VARCHAR(2048) NOT NULL,
   secret               VARCHAR(255)  NOT NULL,
+  previous_secret      TEXT,
+  previous_secret_expires_at TIMESTAMPTZ,
   events               VARCHAR(255)[] NOT NULL DEFAULT '{}',
   active               BOOLEAN       NOT NULL DEFAULT TRUE,
   description          VARCHAR(500),
@@ -47,6 +49,9 @@ CREATE TABLE IF NOT EXISTS webhook_deliveries (
   id              UUID         PRIMARY KEY DEFAULT gen_random_uuid(),
   event_id        UUID         NOT NULL REFERENCES webhook_events(id),
   endpoint_id     UUID         NOT NULL REFERENCES webhook_endpoints(id),
+  endpoint_url_snapshot TEXT,
+  signing_secret_snapshot TEXT,
+  secondary_signing_secret_snapshot TEXT,
   status          VARCHAR(20)  NOT NULL DEFAULT 'PENDING'
                   CHECK (status IN ('PENDING', 'SENDING', 'SENT', 'FAILED')),
   attempts        INT          NOT NULL DEFAULT 0,
@@ -76,3 +81,24 @@ CREATE INDEX IF NOT EXISTS idx_webhook_deliveries_endpoint_status
   ON webhook_deliveries (endpoint_id, status);
 CREATE INDEX IF NOT EXISTS idx_webhook_deliveries_event
   ON webhook_deliveries (event_id);
+
+---
+
+CREATE TABLE IF NOT EXISTS webhook_delivery_attempts (
+  id                        UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  delivery_id               UUID NOT NULL REFERENCES webhook_deliveries(id) ON DELETE CASCADE,
+  attempt_number            INT NOT NULL,
+  status                    VARCHAR(20) NOT NULL
+                            CHECK (status IN ('PENDING', 'SENDING', 'SENT', 'FAILED')),
+  response_status           INT,
+  response_body             TEXT,
+  response_body_truncated   BOOLEAN NOT NULL DEFAULT FALSE,
+  latency_ms                INT,
+  last_error                TEXT,
+  created_at                TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  CONSTRAINT webhook_delivery_attempts_delivery_id_attempt_number_key
+    UNIQUE (delivery_id, attempt_number)
+);
+
+CREATE INDEX IF NOT EXISTS idx_delivery_attempts_delivery_created
+  ON webhook_delivery_attempts (delivery_id, created_at);

package/src/sql/migrations/v0.9.0.sql

@@ -0,0 +1,32 @@
+-- @nestarc/webhook v0.9.0 — additive migration
+-- Adds per-attempt audit logs, endpoint snapshots, and secret rotation overlap.
+
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+ALTER TABLE webhook_endpoints
+  ADD COLUMN IF NOT EXISTS previous_secret TEXT,
+  ADD COLUMN IF NOT EXISTS previous_secret_expires_at TIMESTAMPTZ;
+
+ALTER TABLE webhook_deliveries
+  ADD COLUMN IF NOT EXISTS endpoint_url_snapshot TEXT,
+  ADD COLUMN IF NOT EXISTS signing_secret_snapshot TEXT,
+  ADD COLUMN IF NOT EXISTS secondary_signing_secret_snapshot TEXT;
+
+CREATE TABLE IF NOT EXISTS webhook_delivery_attempts (
+  id                        UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  delivery_id               UUID NOT NULL REFERENCES webhook_deliveries(id) ON DELETE CASCADE,
+  attempt_number            INT NOT NULL,
+  status                    VARCHAR(20) NOT NULL
+                            CHECK (status IN ('PENDING', 'SENDING', 'SENT', 'FAILED')),
+  response_status           INT,
+  response_body             TEXT,
+  response_body_truncated   BOOLEAN NOT NULL DEFAULT FALSE,
+  latency_ms                INT,
+  last_error                TEXT,
+  created_at                TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  CONSTRAINT webhook_delivery_attempts_delivery_id_attempt_number_key
+    UNIQUE (delivery_id, attempt_number)
+);
+
+CREATE INDEX IF NOT EXISTS idx_delivery_attempts_delivery_created
+  ON webhook_delivery_attempts (delivery_id, created_at);