@open-mercato/webhooks 0.10.1-develop.7618.1.ba9531c18e → 0.10.1-develop.7622.1.0584ba2a04

package/src/modules/webhooks/i18n/es.json

@@ -45,9 +45,11 @@
   "webhooks.detail.testResult": "Latest Test Result",
   "webhooks.detail.testSuccess": "Test delivery succeeded.",
   "webhooks.detail.title": "Webhook Detail",
+  "webhooks.errors.credentialHeadersRequireReentry": "El encabezado \"{header}\" tiene un valor oculto. Vuelve a introducirlo o elimínalo al cambiar la URL del webhook.",
   "webhooks.errors.forbidden": "You do not have permission to perform this action.",
   "webhooks.errors.notFound": "Webhook not found.",
   "webhooks.errors.orgRequired": "Organization context required.",
+  "webhooks.errors.redactedHeaderWithoutValue": "El encabezado \"{header}\" tiene un valor oculto, pero no hay ningún valor guardado que conservar. Introduce el valor del encabezado.",
   "webhooks.errors.tenantRequired": "Tenant context required.",
   "webhooks.form.advancedStrategyTip": "HTTP delivery is active today. Use custom headers for routing hints, and keep secrets out of request headers.",
   "webhooks.form.autoDisableThreshold": "Auto-Disable Threshold",
@@ -55,7 +57,7 @@
   "webhooks.form.createError": "Failed to create webhook.",
   "webhooks.form.createSuccess": "Webhook created successfully.",
   "webhooks.form.customHeaders": "Custom Headers",
-  "webhooks.form.customHeadersHint": "Optional JSON object of additional headers to send with each webhook request.",
+  "webhooks.form.customHeadersHint": "Objeto JSON opcional con encabezados adicionales que se envían con cada solicitud del webhook. Los valores ocultos (••••••••) se conservan al guardar; sustituye uno para cambiarlo.",
   "webhooks.form.customHeadersInvalid": "Custom headers must be a valid JSON object with string values.",
   "webhooks.form.customHeadersTip": "Use headers for static metadata such as environment or source identifiers. Do not put access tokens or secrets here.",
   "webhooks.form.deliveryDefaultsTip": "The defaults are a safe starting point for most consumers. Increase retries or timeout only if the receiver is known to be slow.",

package/src/modules/webhooks/i18n/ko.json

@@ -45,9 +45,11 @@
   "webhooks.detail.testResult": "최근 테스트 결과",
   "webhooks.detail.testSuccess": "테스트 전달에 성공했습니다.",
   "webhooks.detail.title": "웹훅 상세 정보",
+  "webhooks.errors.credentialHeadersRequireReentry": "\"{header}\" 헤더에 숨겨진 값이 있습니다. 웹훅 URL을 변경할 때는 값을 다시 입력하거나 헤더를 제거하세요.",
   "webhooks.errors.forbidden": "이 작업을 수행할 권한이 없습니다.",
   "webhooks.errors.notFound": "웹훅을 찾을 수 없습니다.",
   "webhooks.errors.orgRequired": "조직 컨텍스트가 필요합니다.",
+  "webhooks.errors.redactedHeaderWithoutValue": "\"{header}\" 헤더에 숨겨진 값이 있지만 유지할 저장된 값이 없습니다. 헤더 값을 입력하세요.",
   "webhooks.errors.tenantRequired": "테넌트 컨텍스트가 필요합니다.",
   "webhooks.form.advancedStrategyTip": "현재 HTTP 전달이 활성화되어 있습니다. 라우팅 힌트에는 커스텀 헤더를 사용하고, 시크릿은 요청 헤더에 넣지 마세요.",
   "webhooks.form.autoDisableThreshold": "자동 비활성화 임계값",
@@ -55,7 +57,7 @@
   "webhooks.form.createError": "웹훅 생성에 실패했습니다.",
   "webhooks.form.createSuccess": "웹훅이 성공적으로 생성되었습니다.",
   "webhooks.form.customHeaders": "커스텀 헤더",
-  "webhooks.form.customHeadersHint": "각 웹훅 요청과 함께 전송할 추가 헤더의 선택적 JSON 객체입니다.",
+  "webhooks.form.customHeadersHint": "각 웹훅 요청과 함께 전송할 추가 헤더의 선택적 JSON 객체입니다. 숨겨진 값(••••••••)은 저장할 때 유지되며, 변경하려면 새 값으로 바꾸세요.",
   "webhooks.form.customHeadersInvalid": "커스텀 헤더는 문자열 값을 가진 유효한 JSON 객체여야 합니다.",
   "webhooks.form.customHeadersTip": "환경이나 소스 식별자와 같은 정적 메타데이터에 헤더를 사용하세요. 여기에 액세스 토큰이나 시크릿을 넣지 마세요.",
   "webhooks.form.deliveryDefaultsTip": "기본값은 대부분의 소비자에게 안전한 시작점입니다. 수신자가 느린 것으로 알려진 경우에만 재시도 횟수나 시간 제한을 늘리세요.",

package/src/modules/webhooks/i18n/pl.json

@@ -45,9 +45,11 @@
   "webhooks.detail.testResult": "Wynik ostatniego testu",
   "webhooks.detail.testSuccess": "Testowa dostawa powiodła się.",
   "webhooks.detail.title": "Szczegóły webhooka",
+  "webhooks.errors.credentialHeadersRequireReentry": "Nagłówek \"{header}\" ma ukrytą wartość. Wpisz ją ponownie lub usuń nagłówek, gdy zmieniasz adres URL webhooka.",
   "webhooks.errors.forbidden": "Nie masz uprawnień do wykonania tej akcji.",
   "webhooks.errors.notFound": "Nie znaleziono webhooka.",
   "webhooks.errors.orgRequired": "Wymagany jest kontekst organizacji.",
+  "webhooks.errors.redactedHeaderWithoutValue": "Nagłówek \"{header}\" ma ukrytą wartość, ale brak zapisanej wartości do zachowania. Wpisz wartość nagłówka.",
   "webhooks.errors.tenantRequired": "Wymagany jest kontekst najemcy.",
   "webhooks.form.advancedStrategyTip": "Obecnie działa dostawa przez HTTP. Nagłówków własnych używaj do wskazówek routingu i nie umieszczaj w nich sekretów.",
   "webhooks.form.autoDisableThreshold": "Próg automatycznego wyłączenia",
@@ -55,7 +57,7 @@
   "webhooks.form.createError": "Nie udało się utworzyć webhooka.",
   "webhooks.form.createSuccess": "Utworzono webhook.",
   "webhooks.form.customHeaders": "Nagłówki własne",
-  "webhooks.form.customHeadersHint": "Opcjonalny obiekt JSON z dodatkowymi nagłówkami wysyłanymi z każdym żądaniem webhooka.",
+  "webhooks.form.customHeadersHint": "Opcjonalny obiekt JSON z dodatkowymi nagłówkami wysyłanymi z każdym żądaniem webhooka. Ukryte wartości (••••••••) są zachowywane przy zapisie; zastąp wartość, aby ją zmienić.",
   "webhooks.form.customHeadersInvalid": "Nagłówki własne muszą być poprawnym obiektem JSON z wartościami tekstowymi.",
   "webhooks.form.customHeadersTip": "Używaj nagłówków do statycznych metadanych, takich jak środowisko czy identyfikator źródła. Nie umieszczaj w nich tokenów dostępu ani sekretów.",
   "webhooks.form.deliveryDefaultsTip": "Wartości domyślne są bezpiecznym punktem wyjścia dla większości odbiorców. Zwiększaj liczbę ponowień lub limit czasu tylko wtedy, gdy wiesz, że odbiorca działa wolno.",

package/src/modules/webhooks/lib/__tests__/custom-headers.test.ts

@@ -0,0 +1,144 @@
+import {
+  WEBHOOK_REDACTED_HEADER_VALUE as REDACTED,
+  isCredentialWebhookHeader,
+  planWebhookCustomHeadersUpdate,
+  redactWebhookCustomHeaders,
+  resolveRedactedWebhookCustomHeaders,
+} from '../custom-headers'
+
+describe('isCredentialWebhookHeader', () => {
+  it.each([
+    'Authorization',
+    'Proxy-Authorization',
+    'X-API-Key',
+    'x-mock-webhook-token',
+    'X-Signature',
+    'x-sig',
+    'x-session-id',
+    'Cookie',
+    'X-Client-Secret',
+    'x-pass',
+    'X-Functions-Key',
+    'Ocp-Apim-Subscription-Key',
+    'X-Hub-Hmac',
+  ])('treats %s as a credential header', (name) => {
+    expect(isCredentialWebhookHeader(name, 'value')).toBe(true)
+  })
+
+  it.each(['x-source', 'x-environment', 'accept-language', 'x-tenant'])('keeps %s readable', (name) => {
+    expect(isCredentialWebhookHeader(name, 'plain')).toBe(false)
+  })
+
+  it.each([
+    'Bearer abc',
+    'basic dXNlcjpwYXNz',
+    'eyJhbGciOiJIUzI1NiJ9.e30.sig',
+    'sk_live_123',
+    'ghp_abc',
+    'xoxb-123',
+    'glpat-abc',
+  ])('treats a neutral header name with value %s as a credential', (value) => {
+    expect(isCredentialWebhookHeader('x-forward', value)).toBe(true)
+  })
+})
+
+describe('redactWebhookCustomHeaders', () => {
+  it('masks credential values and keeps names and other values', () => {
+    expect(redactWebhookCustomHeaders({ Authorization: 'Bearer t', 'x-source': 'qa' })).toEqual({
+      Authorization: REDACTED,
+      'x-source': 'qa',
+    })
+  })
+
+  it('returns null for missing headers', () => {
+    expect(redactWebhookCustomHeaders(null)).toBeNull()
+    expect(redactWebhookCustomHeaders(undefined)).toBeNull()
+  })
+})
+
+describe('resolveRedactedWebhookCustomHeaders', () => {
+  const stored = { Authorization: 'Bearer t', 'x-source': 'qa' }
+
+  it('restores marked values from storage under the incoming key', () => {
+    expect(resolveRedactedWebhookCustomHeaders({ authorization: REDACTED, 'x-source': 'erp' }, stored)).toEqual({
+      ok: true,
+      headers: { authorization: 'Bearer t', 'x-source': 'erp' },
+      keptStoredValues: ['authorization'],
+    })
+  })
+
+  it('rejects a marker without a stored value', () => {
+    expect(resolveRedactedWebhookCustomHeaders({ 'x-token': REDACTED }, stored)).toEqual({ ok: false, header: 'x-token' })
+    expect(resolveRedactedWebhookCustomHeaders({ 'x-token': REDACTED }, null)).toEqual({ ok: false, header: 'x-token' })
+  })
+
+  it('prefers an exact key over a case-insensitive match', () => {
+    const result = resolveRedactedWebhookCustomHeaders(
+      { authorization: REDACTED },
+      { Authorization: 'Bearer upper', authorization: 'Bearer lower' },
+    )
+    expect(result).toEqual({ ok: true, headers: { authorization: 'Bearer lower' }, keptStoredValues: ['authorization'] })
+  })
+
+  it('never resolves a marker to a stored marker', () => {
+    expect(resolveRedactedWebhookCustomHeaders({ Authorization: REDACTED }, { Authorization: REDACTED })).toEqual({
+      ok: false,
+      header: 'Authorization',
+    })
+  })
+})
+
+describe('planWebhookCustomHeadersUpdate', () => {
+  const current = { url: 'https://example.com/hook', customHeaders: { Authorization: 'Bearer t', 'x-source': 'qa' } }
+
+  it('leaves headers untouched when they are not part of the update', () => {
+    expect(planWebhookCustomHeadersUpdate({ current, next: { url: current.url }, canRevealCredentials: false })).toEqual({
+      ok: true,
+      customHeaders: undefined,
+    })
+  })
+
+  it('refuses to carry stored credentials to a new URL without webhooks.secrets', () => {
+    expect(planWebhookCustomHeadersUpdate({ current, next: { url: 'https://evil.example.net/' }, canRevealCredentials: false })).toEqual({
+      ok: false,
+      reason: 'credentialHeadersRequireReentry',
+      header: 'Authorization',
+    })
+  })
+
+  it('allows a new URL when the stored headers carry no credential', () => {
+    expect(
+      planWebhookCustomHeadersUpdate({
+        current: { url: current.url, customHeaders: { 'x-source': 'qa' } },
+        next: { url: 'https://other.example.net/' },
+        canRevealCredentials: false,
+      }),
+    ).toEqual({ ok: true, customHeaders: undefined })
+  })
+
+  it('treats a path change on the same host as a URL change', () => {
+    expect(
+      planWebhookCustomHeadersUpdate({
+        current,
+        next: { url: 'https://example.com/other-bin', customHeaders: { Authorization: REDACTED } },
+        canRevealCredentials: false,
+      }),
+    ).toMatchObject({ ok: false, reason: 'credentialHeadersRequireReentry' })
+  })
+
+  it('does not count a non-credential header sent back as the marker', () => {
+    expect(
+      planWebhookCustomHeadersUpdate({
+        current,
+        next: { url: 'https://other.example.net/', customHeaders: { 'x-source': REDACTED } },
+        canRevealCredentials: false,
+      }),
+    ).toEqual({ ok: true, customHeaders: { 'x-source': 'qa' } })
+  })
+
+  it('allows clearing headers on a new URL', () => {
+    expect(
+      planWebhookCustomHeadersUpdate({ current, next: { url: 'https://other.example.net/', customHeaders: null }, canRevealCredentials: false }),
+    ).toEqual({ ok: true, customHeaders: null })
+  })
+})

package/src/modules/webhooks/lib/custom-headers.ts

@@ -14,3 +14,87 @@ export function sanitizeWebhookCustomHeaders(
     Object.entries(customHeaders).filter(([name]) => !isReservedWebhookCustomHeader(name)),
   )
 }
+
+export const WEBHOOK_REDACTED_HEADER_VALUE = '••••••••'
+
+const CREDENTIAL_HEADER_NAME_PATTERN = /(auth|token|secret|pass|pwd|key|credential|sig|hmac|session|cookie|jwt|bearer|private)/i
+const CREDENTIAL_HEADER_VALUE_PATTERN = /^(?:(?:bearer|basic|digest|token)\s|eyJ|sk_(?:live|test)_|rk_(?:live|test)_|gh[pousr]_|github_pat_|xox[abpr]-|glpat-)/i
+
+export function isCredentialWebhookHeader(name: string, value?: string | null): boolean {
+  if (CREDENTIAL_HEADER_NAME_PATTERN.test(name.trim())) return true
+  return typeof value === 'string' && CREDENTIAL_HEADER_VALUE_PATTERN.test(value.trim())
+}
+
+export function redactWebhookCustomHeaders(
+  customHeaders: Record<string, string> | null | undefined,
+): Record<string, string> | null {
+  if (!customHeaders) return null
+  return Object.fromEntries(
+    Object.entries(customHeaders).map(([name, value]) => [
+      name,
+      isCredentialWebhookHeader(name, value) ? WEBHOOK_REDACTED_HEADER_VALUE : value,
+    ]),
+  )
+}
+
+export type ResolvedWebhookCustomHeaders =
+  | { ok: true; headers: Record<string, string>; keptStoredValues: string[] }
+  | { ok: false; header: string }
+
+function findStoredHeaderValue(name: string, stored: Record<string, string>): string | null {
+  if (Object.prototype.hasOwnProperty.call(stored, name)) return stored[name]
+  const normalized = name.trim().toLowerCase()
+  const matches = Object.keys(stored).filter((storedName) => storedName.trim().toLowerCase() === normalized)
+  return matches.length === 1 ? stored[matches[0]] : null
+}
+
+export function resolveRedactedWebhookCustomHeaders(
+  next: Record<string, string>,
+  stored: Record<string, string> | null | undefined,
+): ResolvedWebhookCustomHeaders {
+  const headers: Record<string, string> = {}
+  const keptStoredValues: string[] = []
+  for (const [name, value] of Object.entries(next)) {
+    if (value !== WEBHOOK_REDACTED_HEADER_VALUE) {
+      headers[name] = value
+      continue
+    }
+    const storedValue = stored ? findStoredHeaderValue(name, stored) : null
+    if (storedValue === null || storedValue === WEBHOOK_REDACTED_HEADER_VALUE) return { ok: false, header: name }
+    headers[name] = storedValue
+    if (isCredentialWebhookHeader(name, storedValue)) keptStoredValues.push(name)
+  }
+  return { ok: true, headers, keptStoredValues }
+}
+
+export type WebhookCustomHeadersUpdate =
+  | { ok: true; customHeaders: Record<string, string> | null | undefined }
+  | { ok: false; reason: 'redactedHeaderWithoutValue' | 'credentialHeadersRequireReentry'; header: string }
+
+export function planWebhookCustomHeadersUpdate(input: {
+  current: { url: string; customHeaders?: Record<string, string> | null }
+  next: { url?: string; customHeaders?: Record<string, string> | null }
+  canRevealCredentials: boolean
+}): WebhookCustomHeadersUpdate {
+  const { current, next, canRevealCredentials } = input
+  let customHeaders: Record<string, string> | null | undefined = next.customHeaders
+  let keptCredentialHeaders: string[] = []
+
+  if (next.customHeaders === undefined) {
+    keptCredentialHeaders = Object.entries(current.customHeaders ?? {})
+      .filter(([name, value]) => isCredentialWebhookHeader(name, value))
+      .map(([name]) => name)
+  } else if (next.customHeaders !== null) {
+    const resolved = resolveRedactedWebhookCustomHeaders(next.customHeaders, current.customHeaders)
+    if (!resolved.ok) return { ok: false, reason: 'redactedHeaderWithoutValue', header: resolved.header }
+    customHeaders = resolved.headers
+    keptCredentialHeaders = resolved.keptStoredValues
+  }
+
+  const urlChanged = next.url !== undefined && next.url !== current.url
+  if (!canRevealCredentials && urlChanged && keptCredentialHeaders.length > 0) {
+    return { ok: false, reason: 'credentialHeadersRequireReentry', header: keptCredentialHeaders[0] }
+  }
+
+  return { ok: true, customHeaders }
+}