@stacksjs/email 0.70.258 → 0.70.259

package/dist/webhook-signatures.js

@@ -1,148 +1,2 @@
-import { createHmac, createVerify, timingSafeEqual } from "node:crypto";
-import { Buffer } from "node:buffer";
-export function verifyMailgunSignature(input) {
-  if (!input.signingKey)
-    return { ok: !1, reason: "missing-config" };
-  if (!input.timestamp || !input.token || !input.signature)
-    return { ok: !1, reason: "missing-signature" };
-  const tolerance = input.toleranceSeconds ?? 300, ts = Number(input.timestamp);
-  if (!Number.isFinite(ts))
-    return { ok: !1, reason: "bad-signature" };
-  const now = Math.floor(Date.now() / 1000);
-  if (Math.abs(now - ts) > tolerance)
-    return { ok: !1, reason: "expired" };
-  const expected = createHmac("sha256", input.signingKey).update(`${input.timestamp}${input.token}`).digest("hex");
-  let provided;
-  try {
-    provided = Buffer.from(input.signature, "hex");
-  } catch {
-    return { ok: !1, reason: "bad-signature" };
-  }
-  const expectedBuf = Buffer.from(expected, "hex");
-  if (provided.length !== expectedBuf.length)
-    return { ok: !1, reason: "bad-signature" };
-  if (!timingSafeEqual(provided, expectedBuf))
-    return { ok: !1, reason: "bad-signature" };
-  return { ok: !0 };
-}
-export function verifyPostmarkAuth(input) {
-  if (!input.expectedUsername || !input.expectedPassword)
-    return { ok: !1, reason: "missing-config" };
-  if (!input.authorizationHeader || !input.authorizationHeader.startsWith("Basic "))
-    return { ok: !1, reason: "missing-signature" };
-  let decoded;
-  try {
-    decoded = Buffer.from(input.authorizationHeader.slice(6), "base64").toString("utf8");
-  } catch {
-    return { ok: !1, reason: "bad-signature" };
-  }
-  const [user, pass] = decoded.split(":");
-  if (!user || pass === void 0)
-    return { ok: !1, reason: "bad-signature" };
-  const userMatch = safeStringEquals(user, input.expectedUsername), passMatch = safeStringEquals(pass, input.expectedPassword);
-  if (!userMatch || !passMatch)
-    return { ok: !1, reason: "bad-signature" };
-  if (input.ipAllowlist && input.ipAllowlist.length > 0) {
-    if (!input.sourceIp || !input.ipAllowlist.includes(input.sourceIp))
-      return { ok: !1, reason: "bad-signature" };
-  }
-  return { ok: !0 };
-}
-function safeStringEquals(a, b) {
-  const aBuf = Buffer.from(a, "utf8"), bBuf = Buffer.from(b, "utf8");
-  if (aBuf.length !== bBuf.length) {
-    const dummy = Buffer.alloc(Math.max(aBuf.length, bBuf.length));
-    timingSafeEqual(dummy, dummy);
-    return !1;
-  }
-  return timingSafeEqual(aBuf, bBuf);
-}
-const DEFAULT_SNS_HOST_ALLOWLIST = /^sns\.[a-z0-9-]+\.amazonaws\.com$/;
-async function defaultCertFetcher(url) {
-  const res = await fetch(url, { redirect: "error" });
-  if (!res.ok)
-    throw Error(`SNS cert fetch returned ${res.status}`);
-  return await res.text();
-}
-export async function verifySesSnsSignature(input) {
-  const msg = input.message;
-  if (!msg || !msg.Signature || !msg.SigningCertURL)
-    return { ok: !1, reason: "missing-signature" };
-  const allowlist = input.certUrlHostAllowlist ?? DEFAULT_SNS_HOST_ALLOWLIST;
-  let certUrl;
-  try {
-    certUrl = new URL(msg.SigningCertURL);
-  } catch {
-    return { ok: !1, reason: "untrusted-cert-url" };
-  }
-  if (certUrl.protocol !== "https:")
-    return { ok: !1, reason: "untrusted-cert-url" };
-  if (!allowlist.test(certUrl.host))
-    return { ok: !1, reason: "untrusted-cert-url" };
-  let certPem;
-  try {
-    certPem = await (input.fetchCert ?? defaultCertFetcher)(msg.SigningCertURL);
-  } catch {
-    return { ok: !1, reason: "cert-fetch-failed" };
-  }
-  const canonical = canonicalSnsString(msg);
-  if (!canonical)
-    return { ok: !1, reason: "bad-signature" };
-  let sigBuf;
-  try {
-    sigBuf = Buffer.from(msg.Signature, "base64");
-  } catch {
-    return { ok: !1, reason: "bad-signature" };
-  }
-  const algo = msg.SignatureVersion === "2" ? "SHA256" : "SHA1", verifier = createVerify(`RSA-${algo}`);
-  verifier.update(canonical, "utf8");
-  return verifier.verify(certPem, sigBuf) ? { ok: !0 } : { ok: !1, reason: "bad-signature" };
-}
-function canonicalSnsString(msg) {
-  const fields = [];
-  if (msg.Type === "Notification") {
-    fields.push("Message", msg.Message);
-    fields.push("MessageId", msg.MessageId);
-    if (msg.Subject !== void 0)
-      fields.push("Subject", msg.Subject);
-    fields.push("Timestamp", msg.Timestamp);
-    fields.push("TopicArn", msg.TopicArn);
-    fields.push("Type", msg.Type);
-  } else if (msg.Type === "SubscriptionConfirmation" || msg.Type === "UnsubscribeConfirmation") {
-    fields.push("Message", msg.Message);
-    fields.push("MessageId", msg.MessageId);
-    if (!msg.SubscribeURL || !msg.Token)
-      return null;
-    fields.push("SubscribeURL", msg.SubscribeURL);
-    fields.push("Timestamp", msg.Timestamp);
-    fields.push("Token", msg.Token);
-    fields.push("TopicArn", msg.TopicArn);
-    fields.push("Type", msg.Type);
-  } else
-    return null;
-  let out = "";
-  for (const f of fields)
-    out += `${f}
-`;
-  return out;
-}
-export function verifySendgridSignature(input) {
-  if (!input.publicKeyPem)
-    return { ok: !1, reason: "missing-config" };
-  if (!input.signature || !input.timestamp)
-    return { ok: !1, reason: "missing-signature" };
-  const tolerance = input.toleranceSeconds ?? 300, ts = Number(input.timestamp);
-  if (!Number.isFinite(ts))
-    return { ok: !1, reason: "bad-signature" };
-  if (Math.abs(Math.floor(Date.now() / 1000) - ts) > tolerance)
-    return { ok: !1, reason: "expired" };
-  let sigBuf;
-  try {
-    sigBuf = Buffer.from(input.signature, "base64");
-  } catch {
-    return { ok: !1, reason: "bad-signature" };
-  }
-  const verifier = createVerify("SHA256");
-  verifier.update(`${input.timestamp}${input.body}`, "utf8");
-  return verifier.verify(input.publicKeyPem, sigBuf) ? { ok: !0 } : { ok: !1, reason: "bad-signature" };
-}
+import{createHmac,createVerify,timingSafeEqual}from"node:crypto";import{Buffer}from"node:buffer";export function verifyMailgunSignature(input){if(!input.signingKey)return{ok:!1,reason:"missing-config"};if(!input.timestamp||!input.token||!input.signature)return{ok:!1,reason:"missing-signature"};const tolerance=input.toleranceSeconds??300,ts=Number(input.timestamp);if(!Number.isFinite(ts))return{ok:!1,reason:"bad-signature"};const now=Math.floor(Date.now()/1000);if(Math.abs(now-ts)>tolerance)return{ok:!1,reason:"expired"};const expected=createHmac("sha256",input.signingKey).update(`${input.timestamp}${input.token}`).digest("hex");let provided;try{provided=Buffer.from(input.signature,"hex")}catch{return{ok:!1,reason:"bad-signature"}}const expectedBuf=Buffer.from(expected,"hex");if(provided.length!==expectedBuf.length)return{ok:!1,reason:"bad-signature"};if(!timingSafeEqual(provided,expectedBuf))return{ok:!1,reason:"bad-signature"};return{ok:!0}}export function verifyPostmarkAuth(input){if(!input.expectedUsername||!input.expectedPassword)return{ok:!1,reason:"missing-config"};if(!input.authorizationHeader||!input.authorizationHeader.startsWith("Basic "))return{ok:!1,reason:"missing-signature"};let decoded;try{decoded=Buffer.from(input.authorizationHeader.slice(6),"base64").toString("utf8")}catch{return{ok:!1,reason:"bad-signature"}}const[user,pass]=decoded.split(":");if(!user||pass===void 0)return{ok:!1,reason:"bad-signature"};const userMatch=safeStringEquals(user,input.expectedUsername),passMatch=safeStringEquals(pass,input.expectedPassword);if(!userMatch||!passMatch)return{ok:!1,reason:"bad-signature"};if(input.ipAllowlist&&input.ipAllowlist.length>0){if(!input.sourceIp||!input.ipAllowlist.includes(input.sourceIp))return{ok:!1,reason:"bad-signature"}}return{ok:!0}}function safeStringEquals(a,b){const aBuf=Buffer.from(a,"utf8"),bBuf=Buffer.from(b,"utf8");if(aBuf.length!==bBuf.length){const dummy=Buffer.alloc(Math.max(aBuf.length,bBuf.length));timingSafeEqual(dummy,dummy);return!1}return timingSafeEqual(aBuf,bBuf)}const DEFAULT_SNS_HOST_ALLOWLIST=/^sns\.[a-z0-9-]+\.amazonaws\.com$/;async function defaultCertFetcher(url){const res=await fetch(url,{redirect:"error"});if(!res.ok)throw Error(`SNS cert fetch returned ${res.status}`);return await res.text()}export async function verifySesSnsSignature(input){const msg=input.message;if(!msg||!msg.Signature||!msg.SigningCertURL)return{ok:!1,reason:"missing-signature"};const allowlist=input.certUrlHostAllowlist??DEFAULT_SNS_HOST_ALLOWLIST;let certUrl;try{certUrl=new URL(msg.SigningCertURL)}catch{return{ok:!1,reason:"untrusted-cert-url"}}if(certUrl.protocol!=="https:")return{ok:!1,reason:"untrusted-cert-url"};if(!allowlist.test(certUrl.host))return{ok:!1,reason:"untrusted-cert-url"};let certPem;try{certPem=await(input.fetchCert??defaultCertFetcher)(msg.SigningCertURL)}catch{return{ok:!1,reason:"cert-fetch-failed"}}const canonical=canonicalSnsString(msg);if(!canonical)return{ok:!1,reason:"bad-signature"};let sigBuf;try{sigBuf=Buffer.from(msg.Signature,"base64")}catch{return{ok:!1,reason:"bad-signature"}}const algo=msg.SignatureVersion==="2"?"SHA256":"SHA1",verifier=createVerify(`RSA-${algo}`);verifier.update(canonical,"utf8");return verifier.verify(certPem,sigBuf)?{ok:!0}:{ok:!1,reason:"bad-signature"}}function canonicalSnsString(msg){const fields=[];if(msg.Type==="Notification"){fields.push("Message",msg.Message);fields.push("MessageId",msg.MessageId);if(msg.Subject!==void 0)fields.push("Subject",msg.Subject);fields.push("Timestamp",msg.Timestamp);fields.push("TopicArn",msg.TopicArn);fields.push("Type",msg.Type)}else if(msg.Type==="SubscriptionConfirmation"||msg.Type==="UnsubscribeConfirmation"){fields.push("Message",msg.Message);fields.push("MessageId",msg.MessageId);if(!msg.SubscribeURL||!msg.Token)return null;fields.push("SubscribeURL",msg.SubscribeURL);fields.push("Timestamp",msg.Timestamp);fields.push("Token",msg.Token);fields.push("TopicArn",msg.TopicArn);fields.push("Type",msg.Type)}else return null;let out="";for(const f of fields)out+=`${f}
+`;return out}export function verifySendgridSignature(input){if(!input.publicKeyPem)return{ok:!1,reason:"missing-config"};if(!input.signature||!input.timestamp)return{ok:!1,reason:"missing-signature"};const tolerance=input.toleranceSeconds??300,ts=Number(input.timestamp);if(!Number.isFinite(ts))return{ok:!1,reason:"bad-signature"};if(Math.abs(Math.floor(Date.now()/1000)-ts)>tolerance)return{ok:!1,reason:"expired"};let sigBuf;try{sigBuf=Buffer.from(input.signature,"base64")}catch{return{ok:!1,reason:"bad-signature"}}const verifier=createVerify("SHA256");verifier.update(`${input.timestamp}${input.body}`,"utf8");return verifier.verify(input.publicKeyPem,sigBuf)?{ok:!0}:{ok:!1,reason:"bad-signature"}}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/email",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.258",
+  "version": "0.70.259",
   "description": "The Stacks Email integration. Painlessly create & manage your inboxes, templates, and send emails.",
   "author": "Chris Breuer",
   "contributors": [
@@ -35,9 +35,16 @@
       "default": "./dist/index.js"
     },
     "./*": {
-      "bun": "./dist/*",
-      "import": "./dist/*",
-      "default": "./dist/*"
+      "types": "./dist/*.d.ts",
+      "bun": "./dist/*.js",
+      "import": "./dist/*.js",
+      "default": "./dist/*.js"
+    },
+    "./*.js": {
+      "types": "./dist/*.d.ts",
+      "bun": "./dist/*.js",
+      "import": "./dist/*.js",
+      "default": "./dist/*.js"
     }
   },
   "module": "dist/index.js",
@@ -56,10 +63,10 @@
     "@stacksjs/ts-cloud": "^0.7.94"
   },
   "devDependencies": {
-    "@stacksjs/cli": "0.70.258",
-    "@stacksjs/config": "0.70.258",
+    "@stacksjs/cli": "0.70.259",
+    "@stacksjs/config": "0.70.259",
     "better-dx": "^0.2.17",
-    "@stacksjs/error-handling": "0.70.258",
-    "@stacksjs/types": "0.70.258"
+    "@stacksjs/error-handling": "0.70.259",
+    "@stacksjs/types": "0.70.259"
   }
 }