@riverbankcms/sdk 0.78.2 → 0.79.0

package/dist/server/next/revalidate.mjs

@@ -1,56 +1,156 @@
 // src/next/revalidate.ts
 import { revalidateTag, revalidatePath } from "next/cache";
 
-// src/webhooks/verify.ts
-import crypto from "crypto";
+// ../api/src/webhooks.ts
 import { z } from "zod";
-var WebhookEventSchema = z.enum([
+var RIVERBANK_SIGNATURE_PREFIX = "sha256=";
+var SUPPORTED_WEBHOOK_EVENTS = [
   "page.published",
+  "page.unpublished",
+  "page.deleted",
+  "page.path_changed",
   "entry.published",
+  "entry.unpublished",
+  "entry.deleted",
+  "entry.path_changed",
   "navigation.updated",
   "theme.updated",
   "site.settings_updated"
-]);
+];
+var WebhookEventSchema = z.enum(SUPPORTED_WEBHOOK_EVENTS);
+function asRevalidationPath(path) {
+  return path;
+}
+function parseRevalidationPath(input) {
+  const trimmed = input.trim();
+  if (!trimmed) {
+    return { success: false, error: { tag: "EMPTY_PATH", input } };
+  }
+  if (/^[a-z][a-z\d+.-]*:/i.test(trimmed) || trimmed.startsWith("//") || !trimmed.startsWith("/")) {
+    return { success: false, error: { tag: "ABSOLUTE_OR_PROTOCOL_PATH", input } };
+  }
+  if (/[\u0000-\u001F\u007F]/.test(trimmed) || trimmed.includes("\\") || trimmed.includes("?") || trimmed.includes("#")) {
+    return { success: false, error: { tag: "MALFORMED_PATH", input } };
+  }
+  const collapsed = trimmed.replace(/\/{2,}/g, "/");
+  const normalized = collapsed === "/" ? "/" : collapsed.replace(/\/+$/g, "");
+  return { success: true, path: asRevalidationPath(normalized) };
+}
+function normalizeRevalidationPath(input) {
+  const result = parseRevalidationPath(input);
+  return result.success ? result.path : null;
+}
 var PagePublishedDataSchema = z.object({
   pageId: z.string(),
   path: z.string(),
   slug: z.string().optional()
-});
+}).strict();
+var PageRemovedDataSchema = z.object({
+  pageId: z.string(),
+  path: z.string(),
+  slug: z.string().optional()
+}).strict();
+var PagePathChangedDataSchema = z.object({
+  pageId: z.string(),
+  previousPath: z.string(),
+  path: z.string(),
+  slug: z.string().optional()
+}).strict();
 var EntryPublishedDataSchema = z.object({
   entryId: z.string(),
   path: z.string(),
   contentType: z.string()
-});
+}).strict();
+var EntryRemovedDataSchema = z.object({
+  entryId: z.string(),
+  path: z.string(),
+  contentType: z.string()
+}).strict();
+var EntryPathChangedDataSchema = z.object({
+  entryId: z.string(),
+  previousPath: z.string(),
+  path: z.string(),
+  contentType: z.string()
+}).strict();
 var NavigationUpdatedDataSchema = z.object({
   menuId: z.string().optional()
-});
-var EmptyDataSchema = z.object({});
-var WebhookDataSchema = z.union([
-  PagePublishedDataSchema,
-  EntryPublishedDataSchema,
-  NavigationUpdatedDataSchema,
-  EmptyDataSchema
-]);
-var WebhookPayloadSchema = z.object({
-  /** Event type */
-  event: WebhookEventSchema,
-  /** ISO timestamp of when the event occurred */
+}).strict();
+var EmptyWebhookDataSchema = z.object({}).strict();
+var WebhookPayloadBaseSchema = z.object({
   timestamp: z.string(),
-  /** Site ID that triggered the event */
+  dispatchId: z.string().optional(),
   siteId: z.string(),
-  /** Event-specific data (shape depends on event type) */
-  data: z.record(z.string(), z.unknown()),
-  /** Cache invalidation tags (for tag-based revalidation) */
-  tags: z.array(z.string()).optional()
+  tags: z.array(z.string()).optional(),
+  paths: z.array(z.string()).optional()
 });
+var WebhookPayloadSchema = z.discriminatedUnion("event", [
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("page.published"),
+    data: PagePublishedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("page.unpublished"),
+    data: PageRemovedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("page.deleted"),
+    data: PageRemovedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("page.path_changed"),
+    data: PagePathChangedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("entry.published"),
+    data: EntryPublishedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("entry.unpublished"),
+    data: EntryRemovedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("entry.deleted"),
+    data: EntryRemovedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("entry.path_changed"),
+    data: EntryPathChangedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("navigation.updated"),
+    data: NavigationUpdatedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("theme.updated"),
+    data: EmptyWebhookDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("site.settings_updated"),
+    data: EmptyWebhookDataSchema
+  })
+]);
+
+// src/client/types.ts
+var SDK_CORRELATION_HEADER_NAMES = [
+  "x-request-id",
+  "x-correlation-id",
+  "x-riverbank-monitor-run-id"
+];
+
+// src/webhooks/verify.ts
+import crypto from "crypto";
 function verifyWebhookSignature(payload, signature, secret) {
-  const expectedSignature = crypto.createHmac("sha256", secret).update(payload).digest("hex");
-  if (signature.length !== expectedSignature.length) {
+  if (!signature.startsWith(RIVERBANK_SIGNATURE_PREFIX)) {
+    return false;
+  }
+  const signatureDigest = signature.slice(RIVERBANK_SIGNATURE_PREFIX.length);
+  if (!/^[a-f0-9]{64}$/.test(signatureDigest)) {
     return false;
   }
+  const expectedSignature = crypto.createHmac("sha256", secret).update(payload).digest("hex");
   return crypto.timingSafeEqual(
-    Buffer.from(signature),
-    Buffer.from(expectedSignature)
+    Buffer.from(signatureDigest, "hex"),
+    Buffer.from(expectedSignature, "hex")
   );
 }
 function parseWebhookPayload(body) {
@@ -68,6 +168,65 @@ function parseWebhookPayload(body) {
 }
 
 // src/next/revalidate.ts
+var [
+  SDK_REQUEST_ID_HEADER,
+  SDK_CORRELATION_ID_HEADER,
+  SDK_MONITOR_RUN_ID_HEADER
+] = SDK_CORRELATION_HEADER_NAMES;
+var RIVERBANK_DISPATCH_ID_HEADER = "x-riverbank-dispatch-id";
+var RIVERBANK_CORRELATION_ID_HEADER = "x-riverbank-correlation-id";
+function normalizeRevalidationPath2(path) {
+  return normalizeRevalidationPath(path);
+}
+function normalizeRevalidationPaths(paths = []) {
+  const normalized = [];
+  const invalidPaths = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const path of paths) {
+    const normalizedPath = normalizeRevalidationPath2(path);
+    if (!normalizedPath) {
+      invalidPaths.push(path);
+      continue;
+    }
+    if (!seen.has(normalizedPath)) {
+      seen.add(normalizedPath);
+      normalized.push(normalizedPath);
+    }
+  }
+  return { paths: normalized, invalidPaths };
+}
+function normalizeRevalidationTags(tags = []) {
+  const normalized = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const tag of tags) {
+    const trimmed = tag.trim();
+    if (!trimmed || seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    normalized.push(trimmed);
+  }
+  return normalized;
+}
+function getOptionalHeader(headers, name) {
+  const value = headers.get(name)?.trim();
+  return value ? value : void 0;
+}
+function getRevalidationRequestMetadata(request, payload, counts) {
+  const dispatchId = payload.dispatchId ?? getOptionalHeader(request.headers, RIVERBANK_DISPATCH_ID_HEADER);
+  const requestId = getOptionalHeader(request.headers, "x-vercel-id") ?? getOptionalHeader(request.headers, SDK_REQUEST_ID_HEADER);
+  const correlationId = getOptionalHeader(request.headers, RIVERBANK_CORRELATION_ID_HEADER) ?? getOptionalHeader(request.headers, SDK_CORRELATION_ID_HEADER);
+  const monitorRunId = getOptionalHeader(request.headers, SDK_MONITOR_RUN_ID_HEADER);
+  return {
+    event: payload.event,
+    siteId: payload.siteId,
+    ...dispatchId ? { dispatchId } : {},
+    pathCount: counts.pathCount,
+    tagCount: counts.tagCount,
+    itemCount: counts.itemCount,
+    ...requestId ? { requestId } : {},
+    ...correlationId ? { correlationId } : {},
+    ...monitorRunId ? { monitorRunId } : {}
+  };
+}
 function createRevalidateHandler(options = {}) {
   return async function handleRevalidateRequest(request) {
     const secret = options.secret ?? process.env.RIVERBANK_WEBHOOK_SECRET;
@@ -81,41 +240,77 @@ function createRevalidateHandler(options = {}) {
     const body = await request.text();
     const signature = request.headers.get("x-riverbank-signature");
     if (!signature || !verifyWebhookSignature(body, signature, secret)) {
+      console.warn("[Riverbank] Rejected webhook with invalid signature");
       return Response.json({ error: "Invalid signature" }, { status: 401 });
     }
     const parseResult = parseWebhookPayload(body);
     if (!parseResult.success) {
+      console.warn("[Riverbank] Rejected webhook with invalid payload", {
+        reason: parseResult.error
+      });
       return Response.json({ error: parseResult.error }, { status: 400 });
     }
     const payload = parseResult.payload;
     const revalidated = [];
-    if (payload.tags?.length) {
-      for (const tag of payload.tags) {
+    const normalizedPaths = normalizeRevalidationPaths(payload.paths);
+    if (normalizedPaths.invalidPaths.length > 0) {
+      console.warn(
+        "[Riverbank] Ignored invalid revalidation paths",
+        {
+          event: payload.event,
+          siteId: payload.siteId,
+          invalidPathCount: normalizedPaths.invalidPaths.length
+        }
+      );
+    }
+    const normalizedTags = normalizeRevalidationTags(payload.tags);
+    if (normalizedTags.length) {
+      for (const tag of normalizedTags) {
         revalidateTag(tag, "max");
         revalidated.push(`tag:${tag}`);
       }
     }
-    const path = typeof payload.data?.path === "string" ? payload.data.path : void 0;
-    if (path) {
+    for (const path of normalizedPaths.paths) {
       revalidatePath(path);
       revalidated.push(`path:${path}`);
     }
+    const metadata = getRevalidationRequestMetadata(
+      request,
+      payload,
+      {
+        pathCount: normalizedPaths.paths.length,
+        tagCount: normalizedTags.length,
+        itemCount: revalidated.length
+      }
+    );
     if (revalidated.length > 0) {
       console.log(
-        `[Riverbank] Revalidated: ${revalidated.join(", ")} (event: ${payload.event})`
+        [
+          `[Riverbank] Revalidated ${normalizedPaths.paths.length} path(s)`,
+          `and ${normalizedTags.length} tag(s)`,
+          `(event: ${payload.event}, site: ${payload.siteId})`
+        ].join(" "),
+        metadata
       );
     }
     if (options.onRevalidate) {
-      options.onRevalidate(payload, revalidated);
+      options.onRevalidate(payload, revalidated, metadata);
     }
     return Response.json({
       revalidated: true,
       items: revalidated,
       event: payload.event,
+      dispatchId: metadata.dispatchId,
+      pathCount: normalizedPaths.paths.length,
+      tagCount: normalizedTags.length,
+      invalidPathCount: normalizedPaths.invalidPaths.length,
       timestamp: Date.now()
     });
   };
 }
 export {
-  createRevalidateHandler
+  createRevalidateHandler,
+  normalizeRevalidationPath2 as normalizeRevalidationPath,
+  normalizeRevalidationPaths,
+  normalizeRevalidationTags
 };