@praxium/sdk 0.2.13 → 0.2.15

package/dist/revalidation.d.ts

@@ -3,7 +3,16 @@
  *
  * When admin updates data in the platform, a webhook triggers
  * revalidation on the tenant's public website. This handler
- * validates the secret and calls Next.js revalidatePath().
+ * validates the HMAC signature and calls Next.js revalidatePath().
+ *
+ * Signature scheme (H6):
+ *   X-Praxium-Signature: t={unix_timestamp},sha256={HMAC-SHA256(secret, timestamp.body)}
+ *
+ * Security features:
+ *   - HMAC-SHA256 signature verification (secret never sent in body)
+ *   - Timestamp-based replay protection (default 5-minute window)
+ *   - Timing-safe signature comparison (prevents timing side-channel attacks)
+ *   - Web Crypto API (platform-agnostic: Edge, Node.js, browser)
  *
  * Usage in tenant website's `app/api/revalidate/route.ts`:
  *
@@ -16,12 +25,17 @@
  * ```
  */
 interface RevalidationConfig {
-    /** Shared secret for webhook authentication */
+    /** Shared secret for HMAC signature verification */
     secret: string;
+    /** Maximum age of request timestamp in milliseconds (default: 5 minutes) */
+    maxTimestampAge?: number;
 }
 /**
  * Creates a Next.js route handler that revalidates ISR pages
  * when triggered by the Praxium platform webhook.
+ *
+ * Authentication uses HMAC-SHA256 signature verification with
+ * timestamp-based replay protection (H6 security scheme).
  */
 declare function createRevalidationHandler(config: RevalidationConfig): (request: Request) => Promise<Response>;
 

package/dist/revalidation.js

@@ -1,4 +1,22 @@
 // src/revalidation.ts
+var SIGNATURE_HEADER = "X-Praxium-Signature";
+var DEFAULT_MAX_TIMESTAMP_AGE_MS = 5 * 60 * 1e3;
+async function computeHmacSignature(secret, payload) {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign(
+    "HMAC",
+    key,
+    encoder.encode(payload)
+  );
+  return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
 function isSecretValid(provided, expected) {
   const encoder = new TextEncoder();
   const a = encoder.encode(provided);
@@ -12,20 +30,63 @@ function isSecretValid(provided, expected) {
   }
   return mismatch === 0;
 }
+function parseSignatureHeader(headerValue) {
+  const timestampMatch = headerValue.match(/t=(\d+)/);
+  const signatureMatch = headerValue.match(/sha256=([a-f0-9]+)/);
+  if (!timestampMatch || !signatureMatch) {
+    return null;
+  }
+  const timestamp = parseInt(timestampMatch[1], 10);
+  if (isNaN(timestamp) || timestamp <= 0) {
+    return null;
+  }
+  return {
+    timestamp,
+    signature: signatureMatch[1]
+  };
+}
 function createRevalidationHandler(config) {
+  const maxTimestampAge = config.maxTimestampAge ?? DEFAULT_MAX_TIMESTAMP_AGE_MS;
   return async (request) => {
-    let body;
-    try {
-      body = await request.json();
-    } catch {
-      return Response.json({ error: "Invalid JSON body" }, { status: 400 });
+    const signatureHeader = request.headers.get(SIGNATURE_HEADER);
+    if (!signatureHeader) {
+      return Response.json(
+        { error: `Missing ${SIGNATURE_HEADER} header` },
+        { status: 401 }
+      );
     }
-    if (!isSecretValid(body.secret, config.secret)) {
+    const parsed = parseSignatureHeader(signatureHeader);
+    if (!parsed) {
       return Response.json(
-        { error: "Invalid revalidation secret" },
+        { error: "Invalid signature format" },
         { status: 401 }
       );
     }
+    const requestAgeMs = Date.now() - parsed.timestamp * 1e3;
+    if (requestAgeMs > maxTimestampAge) {
+      return Response.json(
+        { error: "Request timestamp expired" },
+        { status: 401 }
+      );
+    }
+    const rawBody = await request.text();
+    const payload = `${parsed.timestamp}.${rawBody}`;
+    const expectedSignature = await computeHmacSignature(
+      config.secret,
+      payload
+    );
+    if (!isSecretValid(parsed.signature, expectedSignature)) {
+      return Response.json(
+        { error: "Invalid signature" },
+        { status: 401 }
+      );
+    }
+    let body;
+    try {
+      body = rawBody ? JSON.parse(rawBody) : {};
+    } catch {
+      return Response.json({ error: "Invalid JSON body" }, { status: 400 });
+    }
     const paths = body.paths ?? ["/"];
     try {
       const { revalidatePath } = await import("next/cache");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@praxium/sdk",
-  "version": "0.2.13",
+  "version": "0.2.15",
   "description": "Official TypeScript SDK for the Praxium platform API",
   "type": "module",
   "exports": {