@odla-ai/chapter 0.31.2 → 0.31.3

package/dist/worker/index.js

@@ -1459,50 +1459,7 @@ var handleSchedule = async (req, url, env, ctx) => {
 };
 
 // src/payments.ts
-function parseSigHeader(header) {
-  const parts = {};
-  for (const p of header.split(",")) {
-    const [k, v] = p.split("=", 2);
-    if (k && v !== void 0) parts[k] = v;
-  }
-  return { t: parts.t, v1: parts.v1 };
-}
-function toHex(buf) {
-  return [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-function timingSafeEqual(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
-async function verifyStripeSignature(payload, header, secret, opts = {}) {
-  const { t, v1 } = parseSigHeader(header);
-  if (!t || !v1) return false;
-  const ts = Number(t);
-  if (!Number.isFinite(ts)) return false;
-  const nowSec = (opts.now ?? Date.now()) / 1e3;
-  const tolerance = opts.toleranceSec ?? 300;
-  if (Math.abs(nowSec - ts) > tolerance) return false;
-  const enc = new TextEncoder();
-  const key = await crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-  const mac = await crypto.subtle.sign("HMAC", key, enc.encode(`${t}.${payload}`));
-  return timingSafeEqual(toHex(mac), v1);
-}
-function stripeForm(params) {
-  const out = new URLSearchParams();
-  for (const [k, v] of Object.entries(params)) {
-    if (v === void 0 || v === null) continue;
-    if (typeof v === "object") {
-      for (const [k2, v2] of Object.entries(v)) {
-        if (v2 !== void 0 && v2 !== null) out.append(`${k}[${k2}]`, String(v2));
-      }
-    } else {
-      out.append(k, String(v));
-    }
-  }
-  return out.toString();
-}
+import { stripeForm, verifyStripeSignature } from "@odla-ai/stripe";
 function webhookMutationId(eventId) {
   return `stripe:${eventId}`;
 }
@@ -1549,18 +1506,15 @@ function canceledPatch() {
 }
 
 // src/payments-stripe.ts
+import { stripeRequest, verifyStripeSignature as verifyStripeSignature2 } from "@odla-ai/stripe";
 async function stripeCall(sk, method, path, params, idempotencyKey) {
-  const qs = method === "GET" && params ? `?${stripeForm(params)}` : "";
-  const headers = { authorization: `Bearer ${sk}` };
-  if (idempotencyKey) headers["idempotency-key"] = idempotencyKey;
-  const init = { method, headers };
-  if (method === "POST" && params) {
-    headers["content-type"] = "application/x-www-form-urlencoded";
-    init.body = stripeForm(params);
-  }
-  const res = await fetch(`https://api.stripe.com${path}${qs}`, init);
-  const body = await res.json().catch(() => ({}));
-  return { ok: res.ok, status: res.status, body };
+  return stripeRequest(
+    { secretKey: sk },
+    method,
+    path,
+    params,
+    idempotencyKey ? { idempotencyKey } : {}
+  );
 }
 function fail(op, r) {
   const err = new Error(`stripe ${op} failed: ${r.status}`);
@@ -1623,7 +1577,7 @@ function createStripeProvider(config) {
       return { customerId, subscriptionId: String(sub.body.id), clientSecret };
     },
     async ingestWebhook(rawBody, sigHeader) {
-      if (!webhookSecret || !await verifyStripeSignature(rawBody, sigHeader, webhookSecret)) {
+      if (!webhookSecret || !await verifyStripeSignature2(rawBody, sigHeader, webhookSecret)) {
         return { ok: false, reason: "bad_signature" };
       }
       const event = JSON.parse(rawBody);