@pikku/core 0.12.133 → 0.12.134

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.12.134
+
+### Patch Changes
+
+- 775b369: A webhook source's `verify` now also checks requests without a body. A bodiless request that is signed can dispatch events, such as Google Calendar and Drive notifications, which carry only headers. One that is not signed can still be answered, as before, so handshakes keep working.
+
 ## 0.12.133
 
 ### Patch Changes

package/dist/wirings/trigger/webhook-source-runner.js

@@ -70,7 +70,7 @@ const signedWith = async (verify, request, secret, services) => {
         return value?.startsWith(prefix) ? value.slice(prefix.length) : undefined;
     };
     if ('hmac' in verify) {
-        const { header: name, prefix, algorithm, encoding, secretEncoding } = verify.hmac;
+        const { header: name, prefix, algorithm, encoding, secretEncoding, } = verify.hmac;
         return verifyHmacSignature(secret, header(name, prefix), algorithm, request.body, encoding, secretEncoding);
     }
     if ('token' in verify) {
@@ -81,23 +81,30 @@ const signedWith = async (verify, request, secret, services) => {
     return verifyPublicKeySignature(secret, header(name), request.body, options);
 };
 /**
- * Whether the request was checked against the source's signing secret. Throws
- * when it was checked and failed. A source without `verify` checks in its own
- * `receive`, and a request without a body has nothing signed to check.
+ * Whether the request was signed with the source's secret. A request with a
+ * body is refused when it was not. A request without one — a HEAD probe, a
+ * validation token in the query — only comes back unverified, so `receive`
+ * can answer it but not dispatch from it. A source without `verify` checks in
+ * its own `receive`.
  */
 const verifyRequest = async (source, request, services) => {
     if (!source?.verify)
         return true;
-    if (request.body.length === 0)
-        return false;
+    const bodiless = request.body.length === 0;
     const secret = await services.credentialService?.get(source.credential ?? webhookSecretCredentialName(source.name));
     if (typeof secret !== 'string' || !secret) {
+        if (bodiless)
+            return false;
         throw new UnauthorizedError(`The ${source.name} webhook source has no signing secret`);
     }
-    if (!(await signedWith(source.verify, request, secret, services))) {
-        throw new UnauthorizedError(`Invalid ${source.name} webhook signature`);
-    }
-    return true;
+    const signed = await signedWith(source.verify, request, secret, services).catch((error) => {
+        if (bodiless)
+            return false;
+        throw error;
+    });
+    if (signed || bodiless)
+        return signed;
+    throw new UnauthorizedError(`Invalid ${source.name} webhook signature`);
 };
 const validateEvents = async (source, events, logger) => {
     const valid = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.133",
+  "version": "0.12.134",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",