@soloworks/smking-next 0.10.0 → 0.12.1

package/src/lib/cms-webhook-route.ts

@@ -1,107 +0,0 @@
-import { revalidateTag } from "next/cache";
-import { Buffer } from "node:buffer";
-import crypto from "node:crypto";
-
-/**
- * SmKing CMS publish webhook handler for Next.js.
- *
- * Drop-in install:
- *
- * ```ts
- * // app/api/smking/webhook/route.ts
- * export { POST } from "@soloworks/smking-next/cms-webhook";
- * ```
- *
- * Then set `SMKING_WEBHOOK_SECRET` in your env and paste this route's
- * full URL (e.g. `https://your-site.com/api/smking/webhook`) into the
- * SmKing dashboard's site settings webhook field.
- *
- * On a verified `cms.page.published` event the handler calls
- * `revalidateTag("smking:cms:<slug>", "default")` — invalidates the
- * cached `getCmsPage` fetch tagged with that slug so the next page
- * render reads fresh content from SaaS.
- *
- * Wire shape matches @smking-saas/features/cms/lib/webhook.ts and the
- * Laravel SDK WebhookController:
- *
- *   POST /api/smking/webhook
- *   X-Smking-Signature: sha256=<hex>
- *   X-Smking-Event: cms.page.published
- *   { event, siteId, slug, publishedAt, deliveredAt }
- *
- * HMAC-SHA256 sig verification runs constant-time via `timingSafeEqual`
- * to prevent secret-extraction via response latency. Unknown event
- * types accept (200) without action so SaaS doesn't retry — forward-
- * compat for future event types (cms.page.unpublished / deleted).
- */
-export async function POST(request: Request): Promise<Response> {
-  const secret = process.env.SMKING_WEBHOOK_SECRET;
-  if (!secret) {
-    return Response.json(
-      { error: "webhook_secret_missing" },
-      { status: 503 },
-    );
-  }
-
-  // Raw body for HMAC verify — re-encoding via JSON.parse + stringify
-  // would change byte order / spacing and invalidate the signature.
-  const rawBody = await request.text();
-  const providedSig = request.headers.get("x-smking-signature");
-  if (!verifySignature(rawBody, providedSig, secret)) {
-    return Response.json({ error: "invalid_signature" }, { status: 401 });
-  }
-
-  let payload: { event?: string; slug?: string };
-  try {
-    payload = JSON.parse(rawBody) as { event?: string; slug?: string };
-  } catch {
-    return Response.json({ error: "invalid_payload" }, { status: 400 });
-  }
-
-  if (
-    payload.event !== "cms.page.published" ||
-    typeof payload.slug !== "string" ||
-    payload.slug.length === 0
-  ) {
-    // Forward-compat: unknown event types ack-without-action so SaaS
-    // doesn't retry. Future event types (cms.page.unpublished) branch
-    // here without breaking older customer SDKs.
-    return Response.json({ ok: true, note: "no_action_taken" });
-  }
-
-  try {
-    // Next.js 16 requires explicit cache profile; "default" matches the
-    // profile a normal `'use cache'` block uses.
-    revalidateTag(`smking:cms:${payload.slug}`, "default");
-  } catch (err) {
-    console.warn(
-      `[@soloworks/smking-next/cms-webhook] revalidateTag failed for slug "${payload.slug}":`,
-      err,
-    );
-    return Response.json({ error: "revalidate_failed" }, { status: 500 });
-  }
-
-  return Response.json({ ok: true, evicted: payload.slug });
-}
-
-function verifySignature(
-  rawBody: string,
-  signatureHeader: string | null,
-  secret: string,
-): boolean {
-  if (!signatureHeader || !signatureHeader.startsWith("sha256=")) return false;
-  const provided = signatureHeader.slice("sha256=".length);
-  const expected = crypto
-    .createHmac("sha256", secret)
-    .update(rawBody)
-    .digest("hex");
-  if (expected.length !== provided.length) return false;
-  try {
-    return crypto.timingSafeEqual(
-      Buffer.from(expected, "hex"),
-      Buffer.from(provided, "hex"),
-    );
-  } catch {
-    return false;
-  }
-}

package/src/route.ts

@@ -1,112 +0,0 @@
-import { revalidateTag } from "next/cache";
-import { Buffer } from "node:buffer";
-import crypto from "node:crypto";
-
-interface WebhookPayload {
-  paths?: string[];
-}
-
-const BEARER_PREFIX = "Bearer ";
-
-/**
- * Webhook handler for SaaS-pushed cache invalidation. Drop-in install:
- *
- *   ```ts
- *   // app/api/smking-revalidate/route.ts
- *   export { POST, GET } from '@soloworks/smking-next/route';
- *   ```
- *
- * Then set `SMKING_WEBHOOK_TOKEN` in your environment and configure the
- * SaaS to POST `{ paths: [...] }` with `Authorization: Bearer <token>`.
- *
- * Bearer-token auth (not HMAC body signing) — sufficient for v1.
- * HMAC-signed body verification can layer on later if attack surface
- * justifies it. Token compare runs through `crypto.timingSafeEqual` to
- * avoid leaking length / prefix info via response time.
- */
-export async function POST(request: Request): Promise<Response> {
-  const expected = process.env.SMKING_WEBHOOK_TOKEN;
-  if (!expected) {
-    return Response.json(
-      { error: "webhook_not_configured" },
-      { status: 503 },
-    );
-  }
-
-  const auth = request.headers.get("authorization");
-  if (!auth || !verifyBearer(auth, expected)) {
-    return Response.json({ error: "unauthorized" }, { status: 401 });
-  }
-
-  let payload: WebhookPayload;
-  try {
-    payload = (await request.json()) as WebhookPayload;
-  } catch {
-    return Response.json({ error: "invalid_json" }, { status: 400 });
-  }
-
-  let revalidated = 0;
-  let errors = 0;
-  for (const p of payload.paths ?? []) {
-    try {
-      // Next.js 16 requires a cache profile; 'default' matches the
-      // implicit profile a normal `'use cache'` block uses.
-      revalidateTag(`smking:path:${p}`, "default");
-      revalidated++;
-    } catch (err) {
-      errors++;
-      console.warn(
-        `[@soloworks/smking-next] revalidateTag failed for path "${p}":`,
-        err,
-      );
-    }
-  }
-
-  return Response.json({ revalidated, errors });
-}
-
-/**
- * Liveness probe — POST-only public endpoint, but `GET` returns 401 with
- * a `WWW-Authenticate` header so customers can verify the route is wired
- * up by sending a token. Discourages anonymous probes from confirming
- * the endpoint exists.
- */
-export async function GET(request: Request): Promise<Response> {
-  const expected = process.env.SMKING_WEBHOOK_TOKEN;
-  if (!expected) {
-    return Response.json(
-      { error: "webhook_not_configured" },
-      { status: 503 },
-    );
-  }
-  const auth = request.headers.get("authorization");
-  if (auth && verifyBearer(auth, expected)) {
-    return new Response("OK", { status: 200 });
-  }
-  return new Response("Unauthorized", {
-    status: 401,
-    headers: { "WWW-Authenticate": 'Bearer realm="smking-webhook"' },
-  });
-}
-
-/**
- * Constant-time bearer-token compare. Returns false on:
- *   - missing or non-Bearer header
- *   - presented token has different length than expected (early-out;
- *     the lengths themselves leak nothing because the secret is set by
- *     the customer with a known length)
- *   - byte-different but same-length token
- */
-function verifyBearer(authHeader: string, expected: string): boolean {
-  if (!authHeader.startsWith(BEARER_PREFIX)) return false;
-  const presented = authHeader.slice(BEARER_PREFIX.length);
-  if (presented.length !== expected.length) return false;
-  try {
-    return crypto.timingSafeEqual(
-      Buffer.from(presented),
-      Buffer.from(expected),
-    );
-  } catch {
-    return false;
-  }
-}