@opengovsg/formsg-sdk 0.15.0 → 7.1.2

package/dist/esm/util/crypto.js

@@ -0,0 +1,74 @@
+import nacl from 'tweetnacl';
+import { decodeBase64, encodeBase64, encodeUTF8 } from 'tweetnacl-util';
+/**
+ * Helper method to generate a new keypair for encryption.
+ * @returns The generated keypair.
+ */
+export var generateKeypair = function () {
+    var kp = nacl.box.keyPair();
+    return {
+        publicKey: encodeBase64(kp.publicKey),
+        secretKey: encodeBase64(kp.secretKey),
+    };
+};
+/**
+ * Helper function to encrypt input with a unique keypair for each submission.
+ * @param msg The message to encrypt
+ * @param theirPublicKey The base-64 encoded public key
+ * @returns The encrypted basestring
+ * @throws error if any of the encrypt methods fail
+ */
+export var encryptMessage = function (msg, theirPublicKey) {
+    var submissionKeypair = generateKeypair();
+    var nonce = nacl.randomBytes(24);
+    var encrypted = encodeBase64(nacl.box(msg, nonce, decodeBase64(theirPublicKey), decodeBase64(submissionKeypair.secretKey)));
+    return "".concat(submissionKeypair.publicKey, ";").concat(encodeBase64(nonce), ":").concat(encrypted);
+};
+/**
+ * Helper method to decrypt an encrypted submission.
+ * @param formPrivateKey base64
+ * @param encryptedContent encrypted string encoded in base64
+ * @return The decrypted content, or null if decryption failed.
+ */
+export var decryptContent = function (formPrivateKey, encryptedContent) {
+    try {
+        var _a = encryptedContent.split(';'), submissionPublicKey = _a[0], nonceEncrypted = _a[1];
+        var _b = nonceEncrypted.split(':').map(decodeBase64), nonce = _b[0], encrypted = _b[1];
+        return nacl.box.open(encrypted, nonce, decodeBase64(submissionPublicKey), decodeBase64(formPrivateKey));
+    }
+    catch (err) {
+        return null;
+    }
+};
+/**
+ * Helper method to verify a signed message.
+ * @param msg the message to verify
+ * @param publicKey the public key to authenticate the signed message with
+ * @returns the signed message if successful, else an error will be thrown
+ * @throws {Error} if the message cannot be verified
+ */
+export var verifySignedMessage = function (msg, publicKey) {
+    var openedMessage = nacl.sign.open(msg, decodeBase64(publicKey));
+    if (!openedMessage)
+        throw new Error('Failed to open signed message with given public key');
+    return JSON.parse(encodeUTF8(openedMessage));
+};
+/**
+ * Helper method to check if all the field IDs given are within the filenames
+ * @param fieldIds the list of fieldIds to check
+ * @param filenames the filenames that should contain the fields
+ * @returns boolean indicating whether the fields are valid
+ */
+export var areAttachmentFieldIdsValid = function (fieldIds, filenames) {
+    return fieldIds.every(function (fieldId) { return filenames[fieldId]; });
+};
+/**
+ * Converts an encrypted attachment to encrypted file content
+ * @param encryptedAttachment The encrypted attachment
+ * @returns EncryptedFileContent The encrypted file content
+ */
+export var convertEncryptedAttachmentToFileContent = function (encryptedAttachment) { return ({
+    submissionPublicKey: encryptedAttachment.encryptedFile.submissionPublicKey,
+    nonce: encryptedAttachment.encryptedFile.nonce,
+    binary: decodeBase64(encryptedAttachment.encryptedFile.binary),
+}); };

package/dist/esm/util/parser.d.ts

@@ -0,0 +1,24 @@
+export type HeaderSignature = {
+    v1: string;
+    t: number;
+    s: string;
+    f: string;
+};
+export type VerificationSignature = {
+    v: string;
+    t: number;
+    s: string;
+    f: string;
+};
+/**
+ * Parses the X-FormSG-Signature header into its constituents
+ * @param header The X-FormSG-Signature header
+ * @returns The signature header constituents
+ */
+export declare const parseSignatureHeader: (header: string) => HeaderSignature;
+/**
+ * Parses the verification signature into its constituent
+ * @param signature The verification signature
+ * @returns The verification signature constituents
+ */
+export declare const parseVerificationSignature: (signature: string) => VerificationSignature;

package/dist/esm/util/parser.js

@@ -0,0 +1,35 @@
+/**
+ * Helper function to retrieve keys-values in a signature.
+ * @param signature The signature to convert to a keymap
+ * @returns The key-value map of the signature
+ */
+var signatureToKeyMap = function (signature) {
+    return signature
+        .split(',')
+        .map(function (kv) { return kv.split(/=(.*)/); })
+        .reduce(function (acc, _a) {
+        var k = _a[0], v = _a[1];
+        acc[k] = v;
+        return acc;
+    }, {});
+};
+/**
+ * Parses the X-FormSG-Signature header into its constituents
+ * @param header The X-FormSG-Signature header
+ * @returns The signature header constituents
+ */
+export var parseSignatureHeader = function (header) {
+    var parsedSignature = signatureToKeyMap(header);
+    parsedSignature.t = Number(parsedSignature.t);
+    return parsedSignature;
+};
+/**
+ * Parses the verification signature into its constituent
+ * @param signature The verification signature
+ * @returns The verification signature constituents
+ */
+export var parseVerificationSignature = function (signature) {
+    var parsedSignature = signatureToKeyMap(signature);
+    parsedSignature.t = Number(parsedSignature.t);
+    return parsedSignature;
+};

package/dist/esm/util/publicKey.d.ts

@@ -0,0 +1,14 @@
+import { PackageMode } from '../types';
+/**
+ * Retrieves the appropriate signing public key.
+ * Defaults to production.
+ * @param mode The package mode to retrieve the public key for.
+ */
+declare function getSigningPublicKey(mode?: PackageMode): string;
+/**
+ * Retrieves the appropriate verification public key.
+ * Defaults to production.
+ * @param mode The package mode to retrieve the public key for.
+ */
+declare function getVerificationPublicKey(mode?: PackageMode): string;
+export { getSigningPublicKey, getVerificationPublicKey };

package/dist/esm/util/publicKey.js

@@ -0,0 +1,38 @@
+import { SIGNING_KEYS } from '../resource/signing-keys';
+import { VERIFICATION_KEYS } from '../resource/verification-keys';
+import STAGE from './stage';
+/**
+ * Retrieves the appropriate signing public key.
+ * Defaults to production.
+ * @param mode The package mode to retrieve the public key for.
+ */
+function getSigningPublicKey(mode) {
+    switch (mode) {
+        case STAGE.development:
+            return SIGNING_KEYS.development.publicKey;
+        case STAGE.staging:
+            return SIGNING_KEYS.staging.publicKey;
+        case STAGE.test:
+            return SIGNING_KEYS.test.publicKey;
+        default:
+            return SIGNING_KEYS.production.publicKey;
+    }
+}
+/**
+ * Retrieves the appropriate verification public key.
+ * Defaults to production.
+ * @param mode The package mode to retrieve the public key for.
+ */
+function getVerificationPublicKey(mode) {
+    switch (mode) {
+        case STAGE.development:
+            return VERIFICATION_KEYS.development.publicKey;
+        case STAGE.staging:
+            return VERIFICATION_KEYS.staging.publicKey;
+        case STAGE.test:
+            return VERIFICATION_KEYS.test.publicKey;
+        default:
+            return VERIFICATION_KEYS.production.publicKey;
+    }
+}
+export { getSigningPublicKey, getVerificationPublicKey };

package/dist/esm/util/signature.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Returns a signature from a basestring and secret key
+ * @param basestring The data you want to sign.
+ * @param secretKey 64-byte secret key in base64 encoding.
+ * @return base64 encoded signature
+ */
+declare function sign(basestring: string, secretKey: string): string;
+/**
+ * Verifies a signature against a message and public key
+ * @param message The message to verify
+ * @param signature The base64 encoded signature generated from sign()
+ * @param publicKey 32-byte public key in base64 encoding
+ * @return True if verification checks out, false otherwise
+ */
+declare function verify(message: string, signature: string, publicKey: string): boolean;
+export { sign, verify };

package/dist/esm/util/signature.js

@@ -0,0 +1,22 @@
+import * as tweetnacl from 'tweetnacl';
+import { decodeBase64, decodeUTF8, encodeBase64 } from 'tweetnacl-util';
+/**
+ * Returns a signature from a basestring and secret key
+ * @param basestring The data you want to sign.
+ * @param secretKey 64-byte secret key in base64 encoding.
+ * @return base64 encoded signature
+ */
+function sign(basestring, secretKey) {
+    return encodeBase64(tweetnacl.sign.detached(decodeUTF8(basestring), decodeBase64(secretKey)));
+}
+/**
+ * Verifies a signature against a message and public key
+ * @param message The message to verify
+ * @param signature The base64 encoded signature generated from sign()
+ * @param publicKey 32-byte public key in base64 encoding
+ * @return True if verification checks out, false otherwise
+ */
+function verify(message, signature, publicKey) {
+    return tweetnacl.sign.detached.verify(decodeUTF8(message), decodeBase64(signature), decodeBase64(publicKey));
+}
+export { sign, verify };

package/dist/esm/util/stage.d.ts

@@ -0,0 +1,5 @@
+import { PackageMode } from '../types';
+declare const STAGE: {
+    [stage in PackageMode]: stage;
+};
+export default STAGE;

package/dist/esm/util/stage.js

@@ -0,0 +1,7 @@
+var STAGE = {
+    staging: 'staging',
+    production: 'production',
+    development: 'development',
+    test: 'test',
+};
+export default STAGE;

package/dist/esm/util/validate.d.ts

@@ -0,0 +1,4 @@
+import { FormField, FormFieldsV3 } from '../types';
+declare function determineIsFormFields(tbd: any): tbd is FormField[];
+declare function determineIsFormFieldsV3(tbd: any): tbd is FormFieldsV3;
+export { determineIsFormFields, determineIsFormFieldsV3 };

package/dist/esm/util/validate.js

@@ -0,0 +1,32 @@
+function determineIsFormFields(tbd) {
+    if (!Array.isArray(tbd)) {
+        return false;
+    }
+    // If there exists even a single internal response that does not fit the
+    // shape, the object is not created properly.
+    var filter = tbd.filter(function (internal) {
+        // Have either answer or answerArray or is isHeader
+        // Since empty strings are allowed, check using typeof.
+        return (typeof internal.answer === 'string' ||
+            Array.isArray(internal.answerArray) ||
+            internal.isHeader) &&
+            internal._id &&
+            internal.fieldType &&
+            // The field is still valid even when the question title is empty string
+            // (even though it is not intended behavior).
+            typeof internal.question === 'string';
+    });
+    return filter.length === tbd.length;
+}
+// TODO(MRF): This is currently very rudimentary, we should look at making this more specific where required.
+function determineIsFormFieldsV3(tbd) {
+    for (var _i = 0, _a = Object.keys(tbd); _i < _a.length; _i++) {
+        var id = _a[_i];
+        var value = tbd[id];
+        var hasCorrectShape = value.fieldType && value.answer !== undefined;
+        if (!hasCorrectShape)
+            return false;
+    }
+    return true;
+}
+export { determineIsFormFields, determineIsFormFieldsV3 };

package/dist/esm/util/webhooks.d.ts

@@ -0,0 +1,20 @@
+import { HeaderSignature } from './parser';
+/**
+ * Helper function to construct the basestring and verify the signature of an
+ * incoming request
+ * @param uri incoming request to verify
+ * @param signatureHeader the X-FormSG-Signature header to verify against
+ * @returns true if verification succeeds, false otherwise
+ * @throws {WebhookAuthenticateError} if given signature header is malformed.
+ */
+declare const isSignatureHeaderValid: (uri: string, signatureHeader: HeaderSignature, publicKey: string) => boolean;
+/**
+ * Helper function to verify that the epoch submitted is recent and valid.
+ * Prevents against replay attacks. Allows for negative time interval
+ * in case of clock drift between Form servers and recipient server.
+ * @param epoch The number of milliseconds since 1 Jan 1970 00:00:00 UTC.
+ * @param expiry Duration of expiry in milliseconds. The default is 5 minutes.
+ * @returns true if the epoch given has exceeded expiry duration calculated from current time.
+ */
+declare const hasEpochExpired: (epoch: number, expiry?: number) => boolean;
+export { isSignatureHeaderValid, hasEpochExpired };

package/dist/esm/util/webhooks.js

@@ -0,0 +1,33 @@
+import * as url from 'url';
+import { WebhookAuthenticateError } from '../errors';
+import { verify } from './signature';
+/**
+ * Helper function to construct the basestring and verify the signature of an
+ * incoming request
+ * @param uri incoming request to verify
+ * @param signatureHeader the X-FormSG-Signature header to verify against
+ * @returns true if verification succeeds, false otherwise
+ * @throws {WebhookAuthenticateError} if given signature header is malformed.
+ */
+var isSignatureHeaderValid = function (uri, signatureHeader, publicKey) {
+    var signature = signatureHeader.v1, epoch = signatureHeader.t, submissionId = signatureHeader.s, formId = signatureHeader.f;
+    if (!epoch || !signature || !submissionId || !formId) {
+        throw new WebhookAuthenticateError('X-FormSG-Signature header is invalid');
+    }
+    var baseString = "".concat(url.parse(uri).href, ".").concat(submissionId, ".").concat(formId, ".").concat(epoch);
+    return verify(baseString, signature, publicKey);
+};
+/**
+ * Helper function to verify that the epoch submitted is recent and valid.
+ * Prevents against replay attacks. Allows for negative time interval
+ * in case of clock drift between Form servers and recipient server.
+ * @param epoch The number of milliseconds since 1 Jan 1970 00:00:00 UTC.
+ * @param expiry Duration of expiry in milliseconds. The default is 5 minutes.
+ * @returns true if the epoch given has exceeded expiry duration calculated from current time.
+ */
+var hasEpochExpired = function (epoch, expiry) {
+    if (expiry === void 0) { expiry = 300000; }
+    var difference = Math.abs(Date.now() - epoch);
+    return difference > expiry;
+};
+export { isSignatureHeaderValid, hasEpochExpired };

package/dist/esm/verification/index.d.ts

@@ -0,0 +1,18 @@
+import { VerificationAuthenticateOptions, VerificationOptions, VerificationSignatureOptions } from '../types';
+export default class Verification {
+    verificationPublicKey?: string;
+    verificationSecretKey?: string;
+    transactionExpiry?: number;
+    constructor(params?: VerificationOptions);
+    /**
+     *  Verifies signature
+     * @param {object} data
+     * @param {string} data.signatureString
+     * @param {number} data.submissionCreatedAt date in milliseconds
+     * @param {string} data.fieldId
+     * @param {string} data.answer
+     * @param {string} data.publicKey
+     */
+    authenticate: ({ signatureString, submissionCreatedAt, fieldId, answer, }: VerificationAuthenticateOptions) => boolean;
+    generateSignature: ({ transactionId, formId, fieldId, answer, }: VerificationSignatureOptions) => string;
+}

package/dist/esm/verification/index.js

@@ -0,0 +1,77 @@
+/**
+ * @file Manages verification of otp form fields (email, sms, whatsapp)
+ * @author Jean Tan
+ */
+import nacl from 'tweetnacl';
+import { decodeBase64, decodeUTF8, encodeBase64 } from 'tweetnacl-util';
+import { MissingPublicKeyError, MissingSecretKeyError } from '../errors';
+import { parseVerificationSignature } from '../util/parser';
+import { formatToBaseString, isSignatureTimeValid } from './utils';
+var Verification = /** @class */ (function () {
+    function Verification(params) {
+        var _this = this;
+        /**
+         *  Verifies signature
+         * @param {object} data
+         * @param {string} data.signatureString
+         * @param {number} data.submissionCreatedAt date in milliseconds
+         * @param {string} data.fieldId
+         * @param {string} data.answer
+         * @param {string} data.publicKey
+         */
+        this.authenticate = function (_a) {
+            var signatureString = _a.signatureString, submissionCreatedAt = _a.submissionCreatedAt, fieldId = _a.fieldId, answer = _a.answer;
+            if (!_this.transactionExpiry) {
+                throw new Error('Provide a transaction expiry when when initializing the FormSG SDK to use this function.');
+            }
+            if (!_this.verificationPublicKey) {
+                throw new MissingPublicKeyError();
+            }
+            try {
+                var _b = parseVerificationSignature(signatureString), transactionId = _b.v, time = _b.t, formId = _b.f, signature = _b.s;
+                if (!time) {
+                    throw new Error('Malformed signature string was passed into function');
+                }
+                if (isSignatureTimeValid(time, submissionCreatedAt, _this.transactionExpiry)) {
+                    var data = formatToBaseString({
+                        transactionId: transactionId,
+                        formId: formId,
+                        fieldId: fieldId,
+                        answer: answer,
+                        time: time,
+                    });
+                    return nacl.sign.detached.verify(decodeUTF8(data), decodeBase64(signature), decodeBase64(_this.verificationPublicKey));
+                }
+                else {
+                    console.info("Signature was expired for signatureString=\"".concat(signatureString, "\" signatureDate=\"").concat(time, "\" submissionCreatedAt=\"").concat(submissionCreatedAt, "\""));
+                    return false;
+                }
+            }
+            catch (error) {
+                console.error("An error occurred for             signatureString=\"".concat(signatureString, "\"             submissionCreatedAt=\"").concat(submissionCreatedAt, "\"             fieldId=\"").concat(fieldId, "\"             answer=\"").concat(answer, "\"             error=\"").concat(error, "\""));
+                return false;
+            }
+        };
+        this.generateSignature = function (_a) {
+            var transactionId = _a.transactionId, formId = _a.formId, fieldId = _a.fieldId, answer = _a.answer;
+            if (!_this.verificationSecretKey) {
+                throw new MissingSecretKeyError('Provide a secret key when when initializing the Verification class to use this function.');
+            }
+            var time = Date.now();
+            var data = formatToBaseString({
+                transactionId: transactionId,
+                formId: formId,
+                fieldId: fieldId,
+                answer: answer,
+                time: time,
+            });
+            var signature = nacl.sign.detached(decodeUTF8(data), decodeBase64(_this.verificationSecretKey));
+            return "f=".concat(formId, ",v=").concat(transactionId, ",t=").concat(time, ",s=").concat(encodeBase64(signature));
+        };
+        this.verificationPublicKey = params === null || params === void 0 ? void 0 : params.publicKey;
+        this.verificationSecretKey = params === null || params === void 0 ? void 0 : params.secretKey;
+        this.transactionExpiry = params === null || params === void 0 ? void 0 : params.transactionExpiry;
+    }
+    return Verification;
+}());
+export default Verification;

package/dist/esm/verification/utils.d.ts

@@ -0,0 +1,12 @@
+import { VerificationBasestringOptions } from '../types';
+/**
+ * Checks if signature was made within the given expiry range before
+ * submission was created.
+ * @param signatureTime ms
+ * @param submissionCreatedAt ms
+ */
+export declare const isSignatureTimeValid: (signatureTime: number, submissionCreatedAt: number, transactionExpiry: number) => boolean;
+/**
+ * Formats given data into a string for signing
+ */
+export declare const formatToBaseString: ({ transactionId, formId, fieldId, answer, time, }: VerificationBasestringOptions) => string;

package/dist/esm/verification/utils.js

@@ -0,0 +1,18 @@
+/**
+ * Checks if signature was made within the given expiry range before
+ * submission was created.
+ * @param signatureTime ms
+ * @param submissionCreatedAt ms
+ */
+export var isSignatureTimeValid = function (signatureTime, submissionCreatedAt, transactionExpiry) {
+    var maxTime = submissionCreatedAt;
+    var minTime = maxTime - transactionExpiry * 1000;
+    return signatureTime > minTime && signatureTime < maxTime;
+};
+/**
+ * Formats given data into a string for signing
+ */
+export var formatToBaseString = function (_a) {
+    var transactionId = _a.transactionId, formId = _a.formId, fieldId = _a.fieldId, answer = _a.answer, time = _a.time;
+    return "".concat(transactionId, ".").concat(formId, ".").concat(fieldId, ".").concat(answer, ".").concat(time);
+};

package/dist/esm/webhooks.d.ts

@@ -0,0 +1,48 @@
+export default class Webhooks {
+    publicKey: string;
+    secretKey?: string;
+    constructor({ publicKey, secretKey, }: {
+        publicKey: string;
+        secretKey?: string;
+    });
+    /**
+     * Injects the webhook public key for authentication
+     * @param header X-FormSG-Signature header
+     * @param uri The endpoint that FormSG is POSTing to
+     * @returns true if the header is verified
+     * @throws {WebhookAuthenticateError} If the signature or uri cannot be verified
+     */
+    authenticate: (header: string, uri: string) => boolean;
+    /**
+     * Generates a signature based on the URI, submission ID and epoch timestamp.
+     * @param params The parameters needed to generate the signature
+     * @param params.uri Full URL of the request
+     * @param params.submissionId Submission Mongo ObjectId saved to the database
+     * @param params.epoch Number of milliseconds since Jan 1, 1970
+     * @returns the generated signature
+     * @throws {MissingSecretKeyError} if a secret key is not provided when instantiating this class
+     * @throws {TypeError} if any parameters are undefined
+     */
+    generateSignature: ({ uri, submissionId, formId, epoch, }: {
+        uri: string;
+        submissionId: string;
+        formId: string;
+        epoch: number;
+    }) => string;
+    /**
+     * Constructs the `X-FormSG-Signature` header
+     * @param params The parameters needed to construct the header
+     * @param params.epoch Epoch timestamp
+     * @param params.submissionId Mongo ObjectId
+     * @param params.formId Mongo ObjectId
+     * @param params.signature A signature generated by the generateSignature() function
+     * @returns The `X-FormSG-Signature` header
+     * @throws {Error} if a secret key is not provided when instantiating this class
+     */
+    constructHeader: ({ epoch, submissionId, formId, signature, }: {
+        epoch: number;
+        submissionId: string;
+        formId: string;
+        signature: string;
+    }) => string;
+}

package/dist/esm/webhooks.js

@@ -0,0 +1,75 @@
+import * as url from 'url';
+import { parseSignatureHeader } from './util/parser';
+import { sign } from './util/signature';
+import { hasEpochExpired, isSignatureHeaderValid } from './util/webhooks';
+import { MissingSecretKeyError, WebhookAuthenticateError } from './errors';
+var Webhooks = /** @class */ (function () {
+    function Webhooks(_a) {
+        var publicKey = _a.publicKey, secretKey = _a.secretKey;
+        var _this = this;
+        /**
+         * Injects the webhook public key for authentication
+         * @param header X-FormSG-Signature header
+         * @param uri The endpoint that FormSG is POSTing to
+         * @returns true if the header is verified
+         * @throws {WebhookAuthenticateError} If the signature or uri cannot be verified
+         */
+        this.authenticate = function (header, uri) {
+            // Parse the header
+            var signatureHeader = parseSignatureHeader(header);
+            var signature = signatureHeader.v1, epoch = signatureHeader.t, submissionId = signatureHeader.s, formId = signatureHeader.f;
+            // Verify signature authenticity
+            if (!isSignatureHeaderValid(uri, signatureHeader, _this.publicKey)) {
+                throw new WebhookAuthenticateError("Signature could not be verified for uri=".concat(uri, " submissionId=").concat(submissionId, " formId=").concat(formId, " epoch=").concat(epoch, " signature=").concat(signature));
+            }
+            // Verify epoch recency
+            if (hasEpochExpired(epoch)) {
+                throw new WebhookAuthenticateError("Signature is not recent for uri=".concat(uri, " submissionId=").concat(submissionId, " formId=").concat(formId, " epoch=").concat(epoch, " signature=").concat(signature));
+            }
+            // All checks pass.
+            return true;
+        };
+        /**
+         * Generates a signature based on the URI, submission ID and epoch timestamp.
+         * @param params The parameters needed to generate the signature
+         * @param params.uri Full URL of the request
+         * @param params.submissionId Submission Mongo ObjectId saved to the database
+         * @param params.epoch Number of milliseconds since Jan 1, 1970
+         * @returns the generated signature
+         * @throws {MissingSecretKeyError} if a secret key is not provided when instantiating this class
+         * @throws {TypeError} if any parameters are undefined
+         */
+        this.generateSignature = function (_a) {
+            var uri = _a.uri, submissionId = _a.submissionId, formId = _a.formId, epoch = _a.epoch;
+            if (!_this.secretKey) {
+                throw new MissingSecretKeyError();
+            }
+            if (!submissionId || !uri || !formId || !epoch) {
+                throw new TypeError('submissionId, uri, formId, or epoch must be provided to generate a webhook signature');
+            }
+            var baseString = "".concat(url.parse(uri).href, ".").concat(submissionId, ".").concat(formId, ".").concat(epoch);
+            return sign(baseString, _this.secretKey);
+        };
+        /**
+         * Constructs the `X-FormSG-Signature` header
+         * @param params The parameters needed to construct the header
+         * @param params.epoch Epoch timestamp
+         * @param params.submissionId Mongo ObjectId
+         * @param params.formId Mongo ObjectId
+         * @param params.signature A signature generated by the generateSignature() function
+         * @returns The `X-FormSG-Signature` header
+         * @throws {Error} if a secret key is not provided when instantiating this class
+         */
+        this.constructHeader = function (_a) {
+            var epoch = _a.epoch, submissionId = _a.submissionId, formId = _a.formId, signature = _a.signature;
+            if (!_this.secretKey) {
+                throw new MissingSecretKeyError();
+            }
+            return "t=".concat(epoch, ",s=").concat(submissionId, ",f=").concat(formId, ",v1=").concat(signature);
+        };
+        this.publicKey = publicKey;
+        this.secretKey = secretKey;
+    }
+    return Webhooks;
+}());
+export default Webhooks;