@prenta/core 0.118.0

package/dist/webhooks/index.js

@@ -0,0 +1,387 @@
+import { getDB } from '../db.js';
+import { validateWebhookUrl } from '../security/webhook.js';
+import { safeFetch, SsrfBlockedError } from '../security/safe-fetch.js';
+import { encryptSecret, decryptSecret } from '../security/secret-storage.js';
+import { prentaWebhookHeaders, signPrentaWebhook, } from './signing.js';
+export { signPayload, verifySignature, signPrentaWebhook, verifyPrentaWebhook, PRENTA_WEBHOOK_TOLERANCE_SECONDS, } from './signing.js';
+const RETRY_DELAYS_MS = [0, 30_000, 120_000, 600_000];
+const DELIVERY_TIMEOUT_MS = 10_000;
+/** Grace window for previous signing secret after rotation. */
+export const WEBHOOK_SECRET_GRACE_MS = 24 * 60 * 60 * 1000;
+function redactEndpoint(ep) {
+    return {
+        id: ep.id,
+        url: ep.url,
+        events: ep.events,
+        active: ep.active,
+        name: ep.name,
+        createdAt: ep.createdAt,
+        updatedAt: ep.updatedAt,
+        previousSecretValidUntil: ep.previousSecretValidUntil ?? null,
+        secret: null,
+        previousSecret: null,
+    };
+}
+// ---------------------------------------------------------------------------
+// Endpoint CRUD (DB-backed)
+// ---------------------------------------------------------------------------
+/**
+ * Create a new webhook endpoint. Validates URL against SSRF rules.
+ * Returns the redacted endpoint plus `plaintextSecret` exactly once.
+ */
+export async function createEndpoint(input) {
+    const urlCheck = validateWebhookUrl(input.url);
+    if (!urlCheck.valid) {
+        throw new Error(`Invalid webhook URL: ${urlCheck.error}`);
+    }
+    const db = getDB();
+    const created = await db.webhookEndpoint.create({
+        data: {
+            url: input.url,
+            events: input.events,
+            secret: await encryptSecret(input.secret),
+            name: input.name ?? null,
+            active: input.active ?? true,
+        },
+    });
+    return { endpoint: redactEndpoint(created), plaintextSecret: input.secret };
+}
+/** List all webhook endpoints (secrets redacted). */
+export async function listEndpoints() {
+    const db = getDB();
+    const rows = await db.webhookEndpoint.findMany({ orderBy: { createdAt: 'desc' } });
+    return rows.map((r) => redactEndpoint(r));
+}
+/** Update a webhook endpoint. Validates URL against SSRF rules if URL is changed. */
+export async function updateEndpoint(id, data) {
+    if (data.url !== undefined) {
+        const urlCheck = validateWebhookUrl(data.url);
+        if (!urlCheck.valid) {
+            throw new Error(`Invalid webhook URL: ${urlCheck.error}`);
+        }
+    }
+    const db = getDB();
+    // Direct secret replace (no grace) — prefer {@link rotateEndpointSecret}.
+    const encryptedSecret = data.secret !== undefined ? await encryptSecret(data.secret) : undefined;
+    const updated = await db.webhookEndpoint.update({
+        where: { id },
+        data: {
+            ...(data.url !== undefined ? { url: data.url } : {}),
+            ...(data.events !== undefined ? { events: data.events } : {}),
+            ...(encryptedSecret !== undefined
+                ? { secret: encryptedSecret, previousSecret: null, previousSecretValidUntil: null }
+                : {}),
+            ...(data.name !== undefined ? { name: data.name } : {}),
+            ...(data.active !== undefined ? { active: data.active } : {}),
+        },
+    });
+    return redactEndpoint(updated);
+}
+/**
+ * Rotate signing secret with a grace window so consumers can verify with
+ * either secret until `previousSecretValidUntil`.
+ */
+export async function rotateEndpointSecret(id, graceMs = WEBHOOK_SECRET_GRACE_MS) {
+    const db = getDB();
+    const existing = await db.webhookEndpoint.findUnique({ where: { id } });
+    if (!existing)
+        throw new Error('Webhook endpoint not found');
+    const plaintextSecret = crypto.randomUUID();
+    const updated = await db.webhookEndpoint.update({
+        where: { id },
+        data: {
+            previousSecret: existing.secret,
+            previousSecretValidUntil: new Date(Date.now() + graceMs),
+            secret: await encryptSecret(plaintextSecret),
+        },
+    });
+    return { endpoint: redactEndpoint(updated), plaintextSecret };
+}
+/** Decrypt current (+ in-grace previous) secrets for signing/verification helpers. */
+export async function resolveEndpointSigningSecrets(endpoint) {
+    const secrets = [await decryptSecret(endpoint.secret)];
+    if (endpoint.previousSecret &&
+        endpoint.previousSecretValidUntil &&
+        endpoint.previousSecretValidUntil.getTime() > Date.now()) {
+        try {
+            secrets.push(await decryptSecret(endpoint.previousSecret));
+        }
+        catch {
+            // Ignore undecryptable previous secrets.
+        }
+    }
+    return secrets;
+}
+/** Delete a webhook endpoint and all its delivery logs. */
+export async function deleteEndpoint(id) {
+    const db = getDB();
+    return db.webhookEndpoint.delete({ where: { id } });
+}
+/** Get recent deliveries for an endpoint. */
+export async function getDeliveries(endpointId, limit = 50) {
+    const db = getDB();
+    return db.webhookDeliveryLog.findMany({
+        where: { endpointId },
+        orderBy: { createdAt: 'desc' },
+        take: limit,
+    });
+}
+/** List webhook deliveries across endpoints (admin inbox / retry UI). */
+export async function listDeliveries(filter = {}) {
+    const db = getDB();
+    const page = Math.max(1, filter.page ?? 1);
+    const pageSize = Math.min(100, Math.max(1, filter.pageSize ?? 25));
+    const statusList = Array.isArray(filter.status)
+        ? filter.status
+        : typeof filter.status === 'string' && filter.status.trim()
+            ? filter.status
+                .split(',')
+                .map((s) => s.trim())
+                .filter(Boolean)
+            : undefined;
+    const where = {};
+    if (statusList?.length)
+        where.status = { in: statusList };
+    if (filter.event)
+        where.event = filter.event;
+    const [docs, total] = await Promise.all([
+        db.webhookDeliveryLog.findMany({
+            where,
+            include: { endpoint: { select: { id: true, name: true, url: true } } },
+            orderBy: { createdAt: 'desc' },
+            skip: (page - 1) * pageSize,
+            take: pageSize,
+        }),
+        db.webhookDeliveryLog.count({ where }),
+    ]);
+    return { docs, total, page, pageSize };
+}
+/**
+ * Retry a single delivery immediately (admin). Decrypts the endpoint secret
+ * and reuses the stored payload.
+ */
+export async function retryDelivery(deliveryId) {
+    const db = getDB();
+    const delivery = await db.webhookDeliveryLog.findUnique({
+        where: { id: deliveryId },
+        include: { endpoint: true },
+    });
+    if (!delivery)
+        throw new Error('Delivery not found');
+    if (!delivery.endpoint)
+        throw new Error('Webhook endpoint missing for this delivery');
+    let signingSecret;
+    try {
+        signingSecret = await decryptSecret(delivery.endpoint.secret);
+    }
+    catch (err) {
+        return {
+            status: 'failed',
+            error: err instanceof Error ? err.message : 'Failed to decrypt webhook secret',
+        };
+    }
+    // Reset to pending so handleFailure can schedule further retries from a clean slate.
+    await db.webhookDeliveryLog.update({
+        where: { id: deliveryId },
+        data: {
+            status: 'pending',
+            nextRetryAt: null,
+            // Keep attempts; attemptDelivery increments on each try.
+        },
+    });
+    const payload = delivery.payload;
+    const ok = await attemptDelivery(deliveryId, delivery.endpoint.url, signingSecret, payload);
+    const updated = await db.webhookDeliveryLog.findUnique({ where: { id: deliveryId } });
+    return {
+        status: updated?.status ?? (ok ? 'success' : 'failed'),
+        ...(ok ? {} : { error: updated?.responseBody ?? 'Delivery failed' }),
+    };
+}
+// ---------------------------------------------------------------------------
+// Event dispatch (DB-persisted with async delivery)
+// ---------------------------------------------------------------------------
+/**
+ * Dispatch a webhook event: finds matching endpoints, creates delivery records,
+ * and attempts immediate delivery. Failed deliveries are queued for retry.
+ */
+export async function dispatch(event, data) {
+    const db = getDB();
+    const endpoints = await db.webhookEndpoint.findMany({
+        where: { active: true },
+    });
+    const matching = endpoints.filter((ep) => {
+        const events = ep.events;
+        return events.includes(event);
+    });
+    if (matching.length === 0) {
+        return { queued: 0, delivered: 0, failed: 0 };
+    }
+    const payload = {
+        event,
+        timestamp: new Date().toISOString(),
+        data,
+    };
+    let delivered = 0;
+    let failed = 0;
+    for (const ep of matching) {
+        const delivery = await db.webhookDeliveryLog.create({
+            data: {
+                endpointId: ep.id,
+                event,
+                payload,
+                status: 'pending',
+                attempts: 0,
+                maxAttempts: 3,
+            },
+        });
+        let signingSecret;
+        try {
+            signingSecret = await decryptSecret(ep.secret);
+        }
+        catch (err) {
+            console.error(`[prenta][webhook] Failed to decrypt secret for endpoint ${ep.id}:`, err instanceof Error ? err.message : err);
+            failed++;
+            continue;
+        }
+        const result = await attemptDelivery(delivery.id, ep.url, signingSecret, payload);
+        if (result) {
+            delivered++;
+        }
+        else {
+            failed++;
+        }
+    }
+    return { queued: matching.length, delivered, failed };
+}
+/**
+ * Attempt a single delivery. Updates the delivery record with result.
+ * On failure, schedules a retry if attempts remain.
+ */
+async function attemptDelivery(deliveryId, url, secret, payload) {
+    const db = getDB();
+    const body = JSON.stringify(payload);
+    try {
+        // Fresh timestamp per HTTP attempt so skew checks stay valid on retry;
+        // X-Prenta-Delivery stays stable for consumer idempotency (#679).
+        const { signature, timestampSec } = await signPrentaWebhook(body, secret);
+        const response = await safeFetch(url, {
+            method: 'POST',
+            headers: prentaWebhookHeaders({
+                signature,
+                timestampSec,
+                event: payload.event,
+                deliveryId,
+            }),
+            body,
+            timeoutMs: DELIVERY_TIMEOUT_MS,
+        });
+        const responseBody = await response.text().catch(() => '');
+        if (response.ok) {
+            await db.webhookDeliveryLog.update({
+                where: { id: deliveryId },
+                data: {
+                    status: 'success',
+                    attempts: { increment: 1 },
+                    lastAttemptAt: new Date(),
+                    responseStatus: response.status,
+                    responseBody: responseBody.substring(0, 1000),
+                    nextRetryAt: null,
+                },
+            });
+            return true;
+        }
+        return handleFailure(deliveryId, response.status, responseBody);
+    }
+    catch (err) {
+        if (err instanceof SsrfBlockedError) {
+            return handleFailure(deliveryId, 0, err.message);
+        }
+        console.error(`[prenta][webhook] Delivery ${deliveryId} failed:`, err?.message ?? 'Connection failed');
+        return handleFailure(deliveryId, 0, err?.message ?? 'Connection failed');
+    }
+}
+async function handleFailure(deliveryId, responseStatus, responseBody) {
+    const db = getDB();
+    const delivery = await db.webhookDeliveryLog.findUnique({
+        where: { id: deliveryId },
+    });
+    const attempt = (delivery?.attempts ?? 0) + 1;
+    const maxAttempts = delivery?.maxAttempts ?? 3;
+    if (attempt >= maxAttempts) {
+        console.error(`[prenta][webhook] Delivery ${deliveryId} permanently failed after ${attempt} attempts (status: ${responseStatus})`);
+        await db.webhookDeliveryLog.update({
+            where: { id: deliveryId },
+            data: {
+                status: 'failed',
+                attempts: attempt,
+                lastAttemptAt: new Date(),
+                responseStatus,
+                responseBody: responseBody.substring(0, 1000),
+                nextRetryAt: null,
+            },
+        });
+    }
+    else {
+        const delay = RETRY_DELAYS_MS[attempt] ?? 600_000;
+        await db.webhookDeliveryLog.update({
+            where: { id: deliveryId },
+            data: {
+                status: 'retrying',
+                attempts: attempt,
+                lastAttemptAt: new Date(),
+                responseStatus,
+                responseBody: responseBody.substring(0, 1000),
+                nextRetryAt: new Date(Date.now() + delay),
+            },
+        });
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Retry processor (called from cron or scheduled task)
+// ---------------------------------------------------------------------------
+/**
+ * Process pending retries. Call this from a cron job (e.g. every 1-2 minutes).
+ * Finds deliveries with status='retrying' and nextRetryAt <= now.
+ */
+export async function processRetries() {
+    const db = getDB();
+    const pending = await db.webhookDeliveryLog.findMany({
+        where: {
+            status: 'retrying',
+            nextRetryAt: { lte: new Date() },
+        },
+        include: { endpoint: true },
+        take: 50,
+    });
+    let succeeded = 0;
+    let failed = 0;
+    for (const delivery of pending) {
+        // `endpoint` is always present (included above); skip-and-fail keeps the
+        // typed optional relation honest if a row is ever orphaned.
+        const endpoint = delivery.endpoint;
+        if (!endpoint) {
+            failed++;
+            continue;
+        }
+        let signingSecret;
+        try {
+            signingSecret = await decryptSecret(endpoint.secret);
+        }
+        catch (err) {
+            console.error(`[prenta][webhook] Retry decrypt failed for delivery ${delivery.id}:`, err instanceof Error ? err.message : err);
+            failed++;
+            continue;
+        }
+        const payload = delivery.payload;
+        const result = await attemptDelivery(delivery.id, endpoint.url, signingSecret, payload);
+        if (result) {
+            succeeded++;
+        }
+        else {
+            failed++;
+        }
+    }
+    return { retried: pending.length, succeeded, failed };
+}
+//# sourceMappingURL=index.js.map

package/dist/webhooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AACvE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAE5E,OAAO,EACL,oBAAoB,EACpB,iBAAiB,GAKlB,MAAM,cAAc,CAAA;AA4BrB,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,gCAAgC,GACjC,MAAM,cAAc,CAAA;AAOrB,MAAM,eAAe,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;AACrD,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAClC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAe1D,SAAS,cAAc,CAAC,EAWvB;IACC,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,GAAG,EAAE,EAAE,CAAC,GAAG;QACX,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,SAAS,EAAE,EAAE,CAAC,SAAS;QACvB,SAAS,EAAE,EAAE,CAAC,SAAS;QACvB,wBAAwB,EAAE,EAAE,CAAC,wBAAwB,IAAI,IAAI;QAC7D,MAAM,EAAE,IAAI;QACZ,cAAc,EAAE,IAAI;KACrB,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAA2B;IAE3B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAY,CAAA;IAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC;QAC9C,IAAI,EAAE;YACJ,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;YACzC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;SAC7B;KACF,CAAC,CAAA;IACF,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;AAC7E,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,EAAE,GAAG,KAAK,EAAY,CAAA;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;IAClF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAA;AAC3C,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU,EAAE,IAAmC;IAClF,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAY,CAAA;IAC5B,0EAA0E;IAC1E,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAChG,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC;QAC9C,KAAK,EAAE,EAAE,EAAE,EAAE;QACb,IAAI,EAAE;YACJ,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,eAAe,KAAK,SAAS;gBAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE;gBACnF,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D;KACF,CAAC,CAAA;IACF,OAAO,cAAc,CAAC,OAAO,CAAC,CAAA;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAU,EACV,UAAkB,uBAAuB;IAEzC,MAAM,EAAE,GAAG,KAAK,EAAY,CAAA;IAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IACvE,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAE5D,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAC3C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC;QAC9C,KAAK,EAAE,EAAE,EAAE,EAAE;QACb,IAAI,EAAE;YACJ,cAAc,EAAE,QAAQ,CAAC,MAAM;YAC/B,wBAAwB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxD,MAAM,EAAE,MAAM,aAAa,CAAC,eAAe,CAAC;SAC7C;KACF,CAAC,CAAA;IACF,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,CAAA;AAC/D,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,QAInD;IACC,MAAM,OAAO,GAAa,CAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAChE,IACE,QAAQ,CAAC,cAAc;QACvB,QAAQ,CAAC,wBAAwB;QACjC,QAAQ,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EACxD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAA;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU;IAC7C,MAAM,EAAE,GAAG,KAAK,EAAY,CAAA;IAC5B,OAAO,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;AACrD,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB,EAAE,KAAK,GAAG,EAAE;IAChE,MAAM,EAAE,GAAG,KAAK,EAAY,CAAA;IAC5B,OAAO,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC;QACpC,KAAK,EAAE,EAAE,UAAU,EAAE;QACrB,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;QAC9B,IAAI,EAAE,KAAK;KACZ,CAAC,CAAA;AACJ,CAAC;AASD,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAA+B,EAAE;IACpE,MAAM,EAAE,GAAG,KAAK,EAAY,CAAA;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAA;IAClE,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,MAAM;QACf,CAAC,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YACzD,CAAC,CAAC,MAAM,CAAC,MAAM;iBACV,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,OAAO,CAAC;YACpB,CAAC,CAAC,SAAS,CAAA;IAEf,MAAM,KAAK,GAA4B,EAAE,CAAA;IACzC,IAAI,UAAU,EAAE,MAAM;QAAE,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,CAAA;IACzD,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;IAE5C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACtC,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC;YAC7B,KAAK;YACL,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;YACtE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC9B,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ;YAC3B,IAAI,EAAE,QAAQ;SACf,CAAC;QACF,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;KACvC,CAAC,CAAA;IAEF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB;IAElB,MAAM,EAAE,GAAG,KAAK,EAAY,CAAA;IAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC;QACtD,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;QACzB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC5B,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACpD,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAErF,IAAI,aAAqB,CAAA;IACzB,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC;SAC/E,CAAA;IACH,CAAC;IAED,qFAAqF;IACrF,MAAM,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;QACjC,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;QACzB,IAAI,EAAE;YACJ,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,IAAI;YACjB,yDAAyD;SAC1D;KACF,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAyB,CAAA;IAClD,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAC3F,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IACrF,OAAO;QACL,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QACtD,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,IAAI,iBAAiB,EAAE,CAAC;KACrE,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,oDAAoD;AACpD,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,KAAmB,EACnB,IAA6B;IAE7B,MAAM,EAAE,GAAG,KAAK,EAAY,CAAA;IAE5B,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC;QAClD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;KACxB,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAO,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,EAAE,CAAC,MAAwB,CAAA;QAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IAC/C,CAAC;IAED,MAAM,OAAO,GAAmB;QAC9B,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI;KACL,CAAA;IAED,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,IAAI,MAAM,GAAG,CAAC,CAAA;IAEd,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAClD,IAAI,EAAE;gBACJ,UAAU,EAAE,EAAE,CAAC,EAAE;gBACjB,KAAK;gBACL,OAAO;gBACP,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,CAAC;gBACX,WAAW,EAAE,CAAC;aACf;SACF,CAAC,CAAA;QAEF,IAAI,aAAqB,CAAA;QACzB,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,CAAA;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,2DAA2D,EAAE,CAAC,EAAE,GAAG,EACnE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAA;YACD,MAAM,EAAE,CAAA;YACR,SAAQ;QACV,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;QACjF,IAAI,MAAM,EAAE,CAAC;YACX,SAAS,EAAE,CAAA;QACb,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAA;QACV,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;AACvD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,UAAkB,EAClB,GAAW,EACX,MAAc,EACd,OAAuB;IAEvB,MAAM,EAAE,GAAG,KAAK,EAAY,CAAA;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IAEpC,IAAI,CAAC;QACH,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAEzE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,oBAAoB,CAAC;gBAC5B,SAAS;gBACT,YAAY;gBACZ,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,UAAU;aACX,CAAC;YACF,IAAI;YACJ,SAAS,EAAE,mBAAmB;SAC/B,CAAC,CAAA;QAEF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;QAE1D,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;gBACjC,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;gBACzB,IAAI,EAAE;oBACJ,MAAM,EAAE,SAAS;oBACjB,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;oBAC1B,aAAa,EAAE,IAAI,IAAI,EAAE;oBACzB,cAAc,EAAE,QAAQ,CAAC,MAAM;oBAC/B,YAAY,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC;oBAC7C,WAAW,EAAE,IAAI;iBAClB;aACF,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACjE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;YACpC,OAAO,aAAa,CAAC,UAAU,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;QAClD,CAAC;QACD,OAAO,CAAC,KAAK,CACX,8BAA8B,UAAU,UAAU,EAClD,GAAG,EAAE,OAAO,IAAI,mBAAmB,CACpC,CAAA;QACD,OAAO,aAAa,CAAC,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,IAAI,mBAAmB,CAAC,CAAA;IAC1E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,UAAkB,EAClB,cAAsB,EACtB,YAAoB;IAEpB,MAAM,EAAE,GAAG,KAAK,EAAY,CAAA;IAE5B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC;QACtD,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;KAC1B,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IAC7C,MAAM,WAAW,GAAG,QAAQ,EAAE,WAAW,IAAI,CAAC,CAAA;IAE9C,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CACX,8BAA8B,UAAU,6BAA6B,OAAO,sBAAsB,cAAc,GAAG,CACpH,CAAA;QACD,MAAM,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;YACjC,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;YACzB,IAAI,EAAE;gBACJ,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,OAAO;gBACjB,aAAa,EAAE,IAAI,IAAI,EAAE;gBACzB,cAAc;gBACd,YAAY,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC;gBAC7C,WAAW,EAAE,IAAI;aAClB;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,OAAO,CAAA;QACjD,MAAM,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;YACjC,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;YACzB,IAAI,EAAE;gBACJ,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,OAAO;gBACjB,aAAa,EAAE,IAAI,IAAI,EAAE;gBACzB,cAAc;gBACd,YAAY,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC;gBAC7C,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;aAC1C;SACF,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAKlC,MAAM,EAAE,GAAG,KAAK,EAAY,CAAA;IAE5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC;QACnD,KAAK,EAAE;YACL,MAAM,EAAE,UAAU;YAClB,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;SACjC;QACD,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC3B,IAAI,EAAE,EAAE;KACT,CAAC,CAAA;IAEF,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,IAAI,MAAM,GAAG,CAAC,CAAA;IAEd,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC/B,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAA;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,EAAE,CAAA;YACR,SAAQ;QACV,CAAC;QACD,IAAI,aAAqB,CAAA;QACzB,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,uDAAuD,QAAQ,CAAC,EAAE,GAAG,EACrE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAA;YACD,MAAM,EAAE,CAAA;YACR,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAyB,CAAA;QAClD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;QACvF,IAAI,MAAM,EAAE,CAAC;YACX,SAAS,EAAE,CAAA;QACb,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAA;QACV,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;AACvD,CAAC"}

package/dist/webhooks/signing.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Prenta outbound webhook signing + consumer verification (#679).
+ *
+ * Scheme (Stripe-inspired):
+ *   signed_payload = `${unixSeconds}.${rawBody}`
+ *   X-Prenta-Signature = hex(HMAC-SHA256(secret, signed_payload))
+ *   X-Prenta-Timestamp = unixSeconds (decimal string)
+ *   X-Prenta-Delivery  = durable delivery / attempt id (idempotency)
+ *   X-Prenta-Event     = event name
+ *
+ * Consumers MUST call {@link verifyPrentaWebhook} (or equivalent) and reject
+ * before side effects when the signature is invalid or the timestamp is outside
+ * the skew window (replay protection).
+ */
+/** Default |now − t| allowance for consumers. */
+export declare const PRENTA_WEBHOOK_TOLERANCE_SECONDS = 300;
+/** Build the string that is HMAC'd. */
+export declare function buildSignedPayload(timestampSec: number, rawBody: string): string;
+/** Sign a raw body with HMAC-SHA256; returns lowercase hex. */
+export declare function signPayload(payload: string, secret: string): Promise<string>;
+/** Constant-time hex signature compare. */
+export declare function verifySignature(payload: string, signature: string, secret: string): Promise<boolean>;
+/**
+ * Sign an outbound Prenta webhook body (timestamp-bound).
+ * Prefer a fresh `timestampSec` per HTTP attempt; use a stable delivery id
+ * for consumer idempotency.
+ */
+export declare function signPrentaWebhook(rawBody: string, secret: string, timestampSec?: number): Promise<{
+    signature: string;
+    timestampSec: number;
+}>;
+export type VerifyPrentaWebhookFailureCode = 'missing_signature' | 'missing_timestamp' | 'invalid_timestamp' | 'timestamp_out_of_tolerance' | 'invalid_signature';
+export type VerifyPrentaWebhookResult = {
+    ok: true;
+    timestampSec: number;
+} | {
+    ok: false;
+    code: VerifyPrentaWebhookFailureCode;
+    message: string;
+};
+export interface VerifyPrentaWebhookInput {
+    /** Exact raw request body bytes as UTF-8 string (must match what was signed). */
+    rawBody: string;
+    /** Value of `X-Prenta-Signature`. */
+    signature: string | null | undefined;
+    /** Value of `X-Prenta-Timestamp` (unix seconds). */
+    timestamp: string | number | null | undefined;
+    /** Current signing secret and optional previous secret (rotation grace). */
+    secrets: string | Array<string | null | undefined>;
+    /** Max |now − t| in seconds. Default {@link PRENTA_WEBHOOK_TOLERANCE_SECONDS}. */
+    toleranceSeconds?: number;
+    /** Override clock for tests. */
+    nowSec?: number;
+}
+/**
+ * Verify an inbound Prenta webhook. Reject (`ok: false`) before any rebuild,
+ * CRM write, or other side effect when this fails.
+ */
+export declare function verifyPrentaWebhook(input: VerifyPrentaWebhookInput): Promise<VerifyPrentaWebhookResult>;
+/** Standard outbound headers for Prenta webhooks. */
+export declare function prentaWebhookHeaders(opts: {
+    signature: string;
+    timestampSec: number;
+    event: string;
+    deliveryId: string;
+    userAgent?: string;
+}): Record<string, string>;
+//# sourceMappingURL=signing.d.ts.map

package/dist/webhooks/signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/webhooks/signing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,iDAAiD;AACjD,eAAO,MAAM,gCAAgC,MAAM,CAAA;AAEnD,uCAAuC;AACvC,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED,+DAA+D;AAC/D,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYlF;AAED,2CAA2C;AAC3C,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,MAAsC,GACnD,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAGtD;AAED,MAAM,MAAM,8BAA8B,GACtC,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,4BAA4B,GAC5B,mBAAmB,CAAA;AAEvB,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,8BAA8B,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAExE,MAAM,WAAW,wBAAwB;IACvC,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAA;IACf,qCAAqC;IACrC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACpC,oDAAoD;IACpD,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAC7C,4EAA4E;IAC5E,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;IAClD,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gCAAgC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAwCpC;AAED,qDAAqD;AACrD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASzB"}

package/dist/webhooks/signing.js

@@ -0,0 +1,98 @@
+/**
+ * Prenta outbound webhook signing + consumer verification (#679).
+ *
+ * Scheme (Stripe-inspired):
+ *   signed_payload = `${unixSeconds}.${rawBody}`
+ *   X-Prenta-Signature = hex(HMAC-SHA256(secret, signed_payload))
+ *   X-Prenta-Timestamp = unixSeconds (decimal string)
+ *   X-Prenta-Delivery  = durable delivery / attempt id (idempotency)
+ *   X-Prenta-Event     = event name
+ *
+ * Consumers MUST call {@link verifyPrentaWebhook} (or equivalent) and reject
+ * before side effects when the signature is invalid or the timestamp is outside
+ * the skew window (replay protection).
+ */
+/** Default |now − t| allowance for consumers. */
+export const PRENTA_WEBHOOK_TOLERANCE_SECONDS = 300;
+/** Build the string that is HMAC'd. */
+export function buildSignedPayload(timestampSec, rawBody) {
+    return `${timestampSec}.${rawBody}`;
+}
+/** Sign a raw body with HMAC-SHA256; returns lowercase hex. */
+export async function signPayload(payload, secret) {
+    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const signature = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(payload));
+    return Array.from(new Uint8Array(signature))
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/** Constant-time hex signature compare. */
+export async function verifySignature(payload, signature, secret) {
+    const expected = await signPayload(payload, secret);
+    if (expected.length !== signature.length)
+        return false;
+    let mismatch = 0;
+    for (let i = 0; i < expected.length; i++) {
+        mismatch |= expected.charCodeAt(i) ^ signature.charCodeAt(i);
+    }
+    return mismatch === 0;
+}
+/**
+ * Sign an outbound Prenta webhook body (timestamp-bound).
+ * Prefer a fresh `timestampSec` per HTTP attempt; use a stable delivery id
+ * for consumer idempotency.
+ */
+export async function signPrentaWebhook(rawBody, secret, timestampSec = Math.floor(Date.now() / 1000)) {
+    const signature = await signPayload(buildSignedPayload(timestampSec, rawBody), secret);
+    return { signature, timestampSec };
+}
+/**
+ * Verify an inbound Prenta webhook. Reject (`ok: false`) before any rebuild,
+ * CRM write, or other side effect when this fails.
+ */
+export async function verifyPrentaWebhook(input) {
+    const signature = typeof input.signature === 'string' ? input.signature.trim() : '';
+    if (!signature) {
+        return { ok: false, code: 'missing_signature', message: 'Missing X-Prenta-Signature' };
+    }
+    const rawTs = input.timestamp;
+    if (rawTs === null || rawTs === undefined || rawTs === '') {
+        return { ok: false, code: 'missing_timestamp', message: 'Missing X-Prenta-Timestamp' };
+    }
+    const timestampSec = typeof rawTs === 'number' ? rawTs : Number(String(rawTs).trim());
+    if (!Number.isFinite(timestampSec) || timestampSec <= 0) {
+        return { ok: false, code: 'invalid_timestamp', message: 'Invalid X-Prenta-Timestamp' };
+    }
+    const nowSec = input.nowSec ?? Math.floor(Date.now() / 1000);
+    const tolerance = input.toleranceSeconds ?? PRENTA_WEBHOOK_TOLERANCE_SECONDS;
+    if (Math.abs(nowSec - timestampSec) > tolerance) {
+        return {
+            ok: false,
+            code: 'timestamp_out_of_tolerance',
+            message: 'Webhook timestamp outside tolerance (possible replay)',
+        };
+    }
+    const secrets = (Array.isArray(input.secrets) ? input.secrets : [input.secrets]).filter((s) => typeof s === 'string' && s.length > 0);
+    if (secrets.length === 0) {
+        return { ok: false, code: 'invalid_signature', message: 'No webhook secrets configured' };
+    }
+    const signed = buildSignedPayload(timestampSec, input.rawBody);
+    for (const secret of secrets) {
+        if (await verifySignature(signed, signature, secret)) {
+            return { ok: true, timestampSec };
+        }
+    }
+    return { ok: false, code: 'invalid_signature', message: 'Invalid webhook signature' };
+}
+/** Standard outbound headers for Prenta webhooks. */
+export function prentaWebhookHeaders(opts) {
+    return {
+        'Content-Type': 'application/json',
+        'X-Prenta-Signature': opts.signature,
+        'X-Prenta-Timestamp': String(opts.timestampSec),
+        'X-Prenta-Event': opts.event,
+        'X-Prenta-Delivery': opts.deliveryId,
+        'User-Agent': opts.userAgent ?? 'PrentaCMS-Webhook/1.0',
+    };
+}
+//# sourceMappingURL=signing.js.map

package/dist/webhooks/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/webhooks/signing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,iDAAiD;AACjD,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,CAAA;AAEnD,uCAAuC;AACvC,MAAM,UAAU,kBAAkB,CAAC,YAAoB,EAAE,OAAe;IACtE,OAAO,GAAG,YAAY,IAAI,OAAO,EAAE,CAAA;AACrC,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,MAAc;IAC/D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IAC1F,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,SAAiB,EACjB,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACtD,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAA;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,MAAc,EACd,eAAuB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEpD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,kBAAkB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;IACtF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAA;AACpC,CAAC;AA4BD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B;IAE/B,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACnF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAA;IACxF,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAA;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAA;IACxF,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACrF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAA;IACxF,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,IAAI,gCAAgC,CAAA;IAC5E,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,YAAY,CAAC,GAAG,SAAS,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,uDAAuD;SACjE,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CACrF,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAC1D,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAA;IAC3F,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAC9D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;QACnC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAA;AACvF,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,oBAAoB,CAAC,IAMpC;IACC,OAAO;QACL,cAAc,EAAE,kBAAkB;QAClC,oBAAoB,EAAE,IAAI,CAAC,SAAS;QACpC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;QAC/C,gBAAgB,EAAE,IAAI,CAAC,KAAK;QAC5B,mBAAmB,EAAE,IAAI,CAAC,UAAU;QACpC,YAAY,EAAE,IAAI,CAAC,SAAS,IAAI,uBAAuB;KACxD,CAAA;AACH,CAAC"}

package/dist/workflow/index.d.ts

@@ -0,0 +1,8 @@
+export type WorkflowStage = 'DRAFT' | 'IN_REVIEW' | 'APPROVED' | 'PUBLISHED' | 'ARCHIVED';
+export declare function canTransition(from: WorkflowStage, to: WorkflowStage, role: string): boolean;
+export declare function getAvailableTransitions(stage: WorkflowStage, role: string): WorkflowStage[];
+export declare function transitionDocument(documentId: string, targetStage: WorkflowStage, userId: string, role: string, note?: string): Promise<{
+    success: boolean;
+    error?: string;
+}>;
+//# sourceMappingURL=index.d.ts.map

package/dist/workflow/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/workflow/index.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,WAAW,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,CAAA;AAUzF,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAI3F;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAI3F;AAED,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,aAAa,EAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC/C"}

package/dist/workflow/index.js

@@ -0,0 +1,56 @@
+import { getDB } from '../db.js';
+const TRANSITIONS = {
+    DRAFT: { next: ['IN_REVIEW'], roles: ['ADMIN', 'EDITOR', 'AUTHOR'] },
+    IN_REVIEW: { next: ['APPROVED', 'DRAFT'], roles: ['ADMIN', 'EDITOR'] },
+    APPROVED: { next: ['PUBLISHED', 'DRAFT'], roles: ['ADMIN', 'EDITOR'] },
+    PUBLISHED: { next: ['ARCHIVED', 'DRAFT'], roles: ['ADMIN'] },
+    ARCHIVED: { next: ['DRAFT'], roles: ['ADMIN'] },
+};
+export function canTransition(from, to, role) {
+    const rule = TRANSITIONS[from];
+    if (!rule)
+        return false;
+    return rule.next.includes(to) && rule.roles.includes(role);
+}
+export function getAvailableTransitions(stage, role) {
+    const rule = TRANSITIONS[stage];
+    if (!rule || !rule.roles.includes(role))
+        return [];
+    return rule.next;
+}
+export async function transitionDocument(documentId, targetStage, userId, role, note) {
+    const db = getDB();
+    const doc = await db.document.findFirst({ where: { id: documentId, deletedAt: null } });
+    if (!doc)
+        return { success: false, error: 'Document not found' };
+    const currentStage = (doc.workflowStage ?? 'DRAFT');
+    if (!canTransition(currentStage, targetStage, role)) {
+        return { success: false, error: `Cannot transition from ${currentStage} to ${targetStage}` };
+    }
+    const updateData = {
+        workflowStage: targetStage,
+        reviewerId: ['IN_REVIEW', 'APPROVED'].includes(targetStage) ? userId : null,
+        reviewNote: note ?? null,
+    };
+    if (targetStage === 'PUBLISHED') {
+        updateData.status = 'PUBLISHED';
+        updateData.publishedAt = new Date();
+    }
+    else if (targetStage === 'DRAFT') {
+        updateData.status = 'DRAFT';
+    }
+    else if (targetStage === 'ARCHIVED') {
+        updateData.status = 'ARCHIVED';
+    }
+    await db.document.update({ where: { id: documentId }, data: updateData });
+    await db.version.create({
+        data: {
+            documentId,
+            data: doc.data ?? {},
+            changedById: userId,
+            changeType: 'UPDATE',
+        },
+    });
+    return { success: true };
+}
+//# sourceMappingURL=index.js.map