@openlup/platform 0.16.0 → 0.18.0

package/src/communications/index.ts

@@ -0,0 +1,47 @@
+export * from "./accountingDocumentDelivery.js";
+export * from "./authEmailError.js";
+export * from "./authSendEmailHook.js";
+export * from "./capturedTransactionalDelivery.js";
+export * from "./communicationSync.js";
+export * from "./communicationSyncWorker.js";
+export * from "./consentPolicy.js";
+export * from "./deliveryReconciliation.js";
+export * from "./contribution.js";
+export * from "./emailHealthAssessment.js";
+export * from "./emailHealthMetricsPort.js";
+export * from "./emailNotificationControl.js";
+export * from "./emailObservation.js";
+export * from "./emailTransport.js";
+export * from "./emailEgress.js";
+export * from "./errors.js";
+export * from "./integrationEventSignature.js";
+export * from "./managedTransactionalDeliveryStore.js";
+export * from "./newsletterIntegrationContracts.js";
+export * from "./newsletterWebhookPort.js";
+export * from "./originPolicy.js";
+export * from "./postgresTransactionalDeliveryStore.js";
+export * from "./preferencesToken.js";
+export * from "./publicPreferenceToken.js";
+export * from "./shipmentNotifications.js";
+export * from "./sql.js";
+export * from "./standardWebhooks.js";
+export * from "./status.js";
+export * from "./transactionalDelivery.js";
+export * from "./transactionalDeliveryIdentifier.js";
+export * from "./unsubscribeToken.js";
+export type * from "./contracts/authEmail.js";
+export type * from "./contracts/email.js";
+export type * from "./contracts/publicIntake.js";
+export type * from "./contracts/transactionalDelivery.js";
+export type * from "./contracts/newsletterWebhook.js";
+export type { NewsletterSyncProviderPort, NewsletterSyncOutcome, NewsletterSyncReconcileOutcome } from "./contracts/newsletter.js";
+export * from "./consentPurposeRegistry.js";
+export type * from "./contracts/consent.js";
+export type * from "./contracts/marketingAutomation.js";
+export * from "./newsletterWebhookProcessing.js";
+export * from "./nativeOperations.js";
+export * from "./postgresDeliveryReconciliation.js";
+export * from "./postgresCommunicationSync.js";
+export * from "./postgresNotificationRecipients.js";
+export * from "./postgresConsentEvaluator.js";
+export type * from "./contracts/marketingSync.js";

package/src/communications/integrationEventSignature.ts

@@ -0,0 +1,49 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+export const COMMUNICATION_INTEGRATION_SIGNATURE_TOLERANCE_SECONDS = 300;
+export const COMMUNICATION_INTEGRATION_SIGNATURE_HEADER = "x-openlup-communications-signature";
+export const COMMUNICATION_INTEGRATION_TIMESTAMP_HEADER = "x-openlup-communications-timestamp";
+
+export function verifyCommunicationIntegrationEventSignature(input: {
+  rawBody: string;
+  signatureHeader: string | undefined;
+  timestampHeader: string | undefined;
+  secret: string;
+  now?: () => number;
+}): boolean {
+  if (!input.secret || !input.signatureHeader || !input.timestampHeader) return false;
+  const timestamp = Number(input.timestampHeader);
+  if (!Number.isFinite(timestamp)) return false;
+  const now = input.now ?? (() => Math.floor(Date.now() / 1000));
+  const age = now() - timestamp;
+  if (age > COMMUNICATION_INTEGRATION_SIGNATURE_TOLERANCE_SECONDS) return false;
+  if (age < -COMMUNICATION_INTEGRATION_SIGNATURE_TOLERANCE_SECONDS) return false;
+
+  const signature = normalizeSignature(input.signatureHeader);
+  const expected = signCommunicationIntegrationEvent({
+    rawBody: input.rawBody,
+    timestamp,
+    secret: input.secret,
+  });
+  return safeEqual(signature, expected);
+}
+
+export function signCommunicationIntegrationEvent(input: {
+  rawBody: string;
+  timestamp: number;
+  secret: string;
+}): string {
+  return createHmac("sha256", input.secret)
+    .update(`${input.timestamp}.${input.rawBody}`)
+    .digest("hex");
+}
+
+function normalizeSignature(value: string): string {
+  return value.trim().replace(/^sha256=/i, "");
+}
+
+function safeEqual(left: string, right: string): boolean {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
+}

package/src/communications/klaviyo/consentPush.ts

@@ -0,0 +1,19 @@
+import type { ConsentPushRequest } from "../contracts/marketingSync.js";
+
+/** Private singleton translation. Local evidence is deliberately absent from wire attributes. */
+export function consentCommand(request: ConsentPushRequest, target: { id: string; email: string }, listId: string | undefined) {
+  if (request.payload.action === "withdraw" && request.audience.kind === "audience") {
+    if (!listId) throw new Error("scope");
+    return { method: "DELETE", path: `/api/lists/${listId}/relationships/profiles`, expected: [204],
+      body: { data: [{ type: "profile", id: target.id }] } };
+  }
+  const grant = request.payload.action === "grant";
+  const type = grant ? "profile-subscription-bulk-create-job" : "profile-subscription-bulk-delete-job";
+  if (grant && !listId) throw new Error("scope");
+  return { method: "POST", path: `/api/${type}s`, expected: [202], body: { data: { type,
+    attributes: { profiles: { data: [{ type: "profile", ...(grant ? { id: target.id } : {}), attributes: {
+      email: target.email, subscriptions: { email: { marketing: { consent: grant ? "SUBSCRIBED" : "UNSUBSCRIBED" } } },
+    } }] } },
+    ...(grant ? { relationships: { list: { data: { type: "list", id: listId } } } } : {}),
+  } } };
+}