@palbase/backend 12.0.0 → 12.0.1

package/dist/index.js

@@ -1292,6 +1292,24 @@ function getWebhookConfig(ctor) {
       "@Webhook requires either a `provider` preset or an explicit `signature` \u2014 an endpoint with no verification would accept forged deliveries"
     );
   }
+  if (meta.signature) {
+    const sig = meta.signature;
+    if (!sig.header) {
+      throw new Error("@Webhook signature requires `header` \u2014 the header the signature arrives in");
+    }
+    if (sig.algo !== "hmac-sha256" && sig.algo !== "hmac-sha1") {
+      throw new Error(`@Webhook signature has an unsupported algo "${sig.algo}"`);
+    }
+    if (sig.encoding !== "hex" && sig.encoding !== "base64") {
+      throw new Error(`@Webhook signature has an unsupported encoding "${sig.encoding}"`);
+    }
+    if (!sig.signs?.includes("{body}")) {
+      throw new Error("@Webhook signature `signs` must contain {body} \u2014 signing a constant is not a signature");
+    }
+    if (sig.signs.includes("{ts}") && !sig.timestampHeader) {
+      throw new Error("@Webhook signature uses {ts} but declares no `timestampHeader` to read it from");
+    }
+  }
   if (!meta.secret?.env) {
     throw new Error('@Webhook requires `secret: { env: "VAR_NAME" }`');
   }