@startup-api/cloudflare 0.0.1 → 0.1.0

package/src/webhooks/md5hmac.ts

@@ -0,0 +1,140 @@
+/**
+ * Pure-TS MD5 and HMAC-MD5.
+ *
+ * Patreon signs webhook payloads with HMAC-MD5 of the raw request body keyed by the webhook secret,
+ * hex-encoded in the `X-Patreon-Signature` header. WebCrypto's SubtleCrypto does not support MD5, so
+ * we implement it by hand. This is used ONLY for verifying inbound webhook signatures — MD5 is not
+ * used for any security primitive that depends on collision resistance.
+ */
+
+// Per-round shift amounts.
+const S = [
+  7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 4, 11, 16, 23,
+  4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21,
+];
+
+// Binary integer parts of the sines of integers (constants) — the standard MD5 T table.
+const K = new Uint32Array([
+  0xd76aa478, 0xe8c7b756, 0x242070db, 0xc1bdceee, 0xf57c0faf, 0x4787c62a, 0xa8304613, 0xfd469501, 0x698098d8, 0x8b44f7af, 0xffff5bb1,
+  0x895cd7be, 0x6b901122, 0xfd987193, 0xa679438e, 0x49b40821, 0xf61e2562, 0xc040b340, 0x265e5a51, 0xe9b6c7aa, 0xd62f105d, 0x02441453,
+  0xd8a1e681, 0xe7d3fbc8, 0x21e1cde6, 0xc33707d6, 0xf4d50d87, 0x455a14ed, 0xa9e3e905, 0xfcefa3f8, 0x676f02d9, 0x8d2a4c8a, 0xfffa3942,
+  0x8771f681, 0x6d9d6122, 0xfde5380c, 0xa4beea44, 0x4bdecfa9, 0xf6bb4b60, 0xbebfbc70, 0x289b7ec6, 0xeaa127fa, 0xd4ef3085, 0x04881d05,
+  0xd9d4d039, 0xe6db99e5, 0x1fa27cf8, 0xc4ac5665, 0xf4292244, 0x432aff97, 0xab9423a7, 0xfc93a039, 0x655b59c3, 0x8f0ccc92, 0xffeff47d,
+  0x85845dd1, 0x6fa87e4f, 0xfe2ce6e0, 0xa3014314, 0x4e0811a1, 0xf7537e82, 0xbd3af235, 0x2ad7d2bb, 0xeb86d391,
+]);
+
+function rotl(x: number, c: number): number {
+  return ((x << c) | (x >>> (32 - c))) >>> 0;
+}
+
+export function md5(message: Uint8Array): Uint8Array {
+  const origLenBits = message.length * 8;
+  const paddedLen = ((((message.length + 8) >>> 6) + 1) << 6) >>> 0; // multiple of 64 with room for the length
+  const bytes = new Uint8Array(paddedLen);
+  bytes.set(message);
+  bytes[message.length] = 0x80;
+
+  const dv = new DataView(bytes.buffer);
+  dv.setUint32(paddedLen - 8, origLenBits >>> 0, true);
+  dv.setUint32(paddedLen - 4, Math.floor(origLenBits / 2 ** 32) >>> 0, true);
+
+  let a0 = 0x67452301;
+  let b0 = 0xefcdab89;
+  let c0 = 0x98badcfe;
+  let d0 = 0x10325476;
+
+  const M = new Uint32Array(16);
+  for (let chunk = 0; chunk < paddedLen; chunk += 64) {
+    for (let i = 0; i < 16; i++) M[i] = dv.getUint32(chunk + i * 4, true);
+
+    let A = a0;
+    let B = b0;
+    let C = c0;
+    let D = d0;
+
+    for (let i = 0; i < 64; i++) {
+      let F: number;
+      let g: number;
+      if (i < 16) {
+        F = (B & C) | (~B & D);
+        g = i;
+      } else if (i < 32) {
+        F = (D & B) | (~D & C);
+        g = (5 * i + 1) % 16;
+      } else if (i < 48) {
+        F = B ^ C ^ D;
+        g = (3 * i + 5) % 16;
+      } else {
+        F = C ^ (B | ~D);
+        g = (7 * i) % 16;
+      }
+      F = (F + A + K[i] + M[g]) >>> 0;
+      A = D;
+      D = C;
+      C = B;
+      B = (B + rotl(F, S[i])) >>> 0;
+    }
+
+    a0 = (a0 + A) >>> 0;
+    b0 = (b0 + B) >>> 0;
+    c0 = (c0 + C) >>> 0;
+    d0 = (d0 + D) >>> 0;
+  }
+
+  const out = new Uint8Array(16);
+  const odv = new DataView(out.buffer);
+  odv.setUint32(0, a0, true);
+  odv.setUint32(4, b0, true);
+  odv.setUint32(8, c0, true);
+  odv.setUint32(12, d0, true);
+  return out;
+}
+
+function concat(a: Uint8Array, b: Uint8Array): Uint8Array {
+  const out = new Uint8Array(a.length + b.length);
+  out.set(a);
+  out.set(b, a.length);
+  return out;
+}
+
+export function hmacMd5(key: Uint8Array, message: Uint8Array): Uint8Array {
+  const blockSize = 64;
+  let k = key;
+  if (k.length > blockSize) k = md5(k);
+  if (k.length < blockSize) {
+    const padded = new Uint8Array(blockSize);
+    padded.set(k);
+    k = padded;
+  }
+
+  const oKeyPad = new Uint8Array(blockSize);
+  const iKeyPad = new Uint8Array(blockSize);
+  for (let i = 0; i < blockSize; i++) {
+    oKeyPad[i] = k[i] ^ 0x5c;
+    iKeyPad[i] = k[i] ^ 0x36;
+  }
+
+  return md5(concat(oKeyPad, md5(concat(iKeyPad, message))));
+}
+
+function toHex(bytes: Uint8Array): string {
+  let s = '';
+  for (const b of bytes) s += b.toString(16).padStart(2, '0');
+  return s;
+}
+
+/** Hex-encoded HMAC-MD5 of `body` keyed by `secret` (both UTF-8). */
+export function hmacMd5Hex(secret: string, body: string): string {
+  const enc = new TextEncoder();
+  return toHex(hmacMd5(enc.encode(secret), enc.encode(body)));
+}
+
+/** Length-and-content constant-time string comparison (hex digests). */
+export function timingSafeEqual(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  let result = 0;
+  for (let i = 0; i < a.length; i++) {
+    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return result === 0;
+}

package/src/webhooks/patreon.ts

@@ -0,0 +1,61 @@
+import type { StartupAPIEnv } from '../StartupAPIEnv';
+import { hmacMd5Hex, timingSafeEqual } from './md5hmac';
+import { computeRedirectBase, getProvider } from '../auth/providers';
+import type { ProviderConfigs } from '../auth/providers';
+import { refreshEntitlements } from '../entitlements/service';
+
+/**
+ * Handle a Patreon webhook (members:pledge:create|update|delete and similar). Verifies the
+ * `X-Patreon-Signature` HMAC-MD5 over the raw body, then re-fetches the affected patron's entitlements
+ * so gating reflects the change. Responds 200 quickly and does the refresh in the background.
+ *
+ * Mounted only when the Patreon provider has `webhook` enabled in the factory config; if the webhook
+ * secret is not configured, returns 404 (route effectively disabled).
+ */
+export async function handlePatreonWebhook(
+  request: Request,
+  env: StartupAPIEnv,
+  ctx?: ExecutionContext,
+  providerConfigs: ProviderConfigs = {},
+): Promise<Response> {
+  const secret = env.PATREON_WEBHOOK_SECRET;
+  if (!secret) return new Response('Webhook not configured', { status: 404 });
+  if (request.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+
+  const signature = request.headers.get('X-Patreon-Signature') || '';
+  const body = await request.text();
+  const expected = hmacMd5Hex(secret, body);
+  if (!signature || !timingSafeEqual(signature.toLowerCase(), expected)) {
+    return new Response('Invalid signature', { status: 401 });
+  }
+
+  let payload: any;
+  try {
+    payload = JSON.parse(body);
+  } catch {
+    return new Response('Bad payload', { status: 400 });
+  }
+
+  // The webhook 'data' is a JSON:API member; the patron's Patreon user id is our credential subject_id.
+  const subjectId = payload?.data?.relationships?.user?.data?.id;
+  if (!subjectId) return new Response('OK', { status: 200 }); // ack — nothing to do
+
+  const work = (async () => {
+    try {
+      const credStub = env.CREDENTIAL.get(env.CREDENTIAL.idFromName('patreon'));
+      const cred = await credStub.get(String(subjectId));
+      if (!cred) return;
+      const redirectBase = computeRedirectBase(env, env.AUTH_ORIGIN || 'https://localhost', '/users/');
+      const provider = getProvider(env, redirectBase, 'patreon', providerConfigs);
+      if (!provider) return;
+      await refreshEntitlements(env, provider, { ...cred, user_id: cred.user_id }, 'webhook');
+    } catch (e) {
+      console.error('[webhook] patreon entitlement refresh failed', e);
+    }
+  })();
+
+  if (ctx) ctx.waitUntil(work);
+  else await work;
+
+  return new Response('OK', { status: 200 });
+}

package/worker-configuration.d.ts

@@ -1,5 +1,5 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types` (hash: c70f035350bd314cfa3f52dffa2be560)
+// Generated by Wrangler by running `wrangler types` (hash: 38595a6a948093665f11cb1bc4cd28e8)
 // Runtime types generated with workerd@1.20260120.0 2025-09-27 global_fetch_strictly_public
 declare namespace Cloudflare {
 	interface GlobalProps {
@@ -33,6 +33,9 @@ declare namespace Cloudflare {
 		TWITCH_CLIENT_SECRET: "";
 		GOOGLE_CLIENT_ID: "";
 		GOOGLE_CLIENT_SECRET: "";
+		PATREON_CLIENT_ID: "";
+		PATREON_CLIENT_SECRET: "";
+		PATREON_WEBHOOK_SECRET: "";
 		GITHUB_PROJECT_ID: string;
 		USER: DurableObjectNamespace<import("./src/index").UserDO>;
 		ACCOUNT: DurableObjectNamespace<import("./src/index").AccountDO>;
@@ -50,6 +53,9 @@ declare namespace Cloudflare {
 		GOOGLE_CLIENT_SECRET: "google-secret";
 		TWITCH_CLIENT_ID: "twitch-id";
 		TWITCH_CLIENT_SECRET: "twitch-secret";
+		PATREON_CLIENT_ID: "patreon-id";
+		PATREON_CLIENT_SECRET: "patreon-secret";
+		PATREON_WEBHOOK_SECRET: "whsec-test";
 		GITHUB_PROJECT_ID: string;
 		USER: DurableObjectNamespace<import("./src/index").UserDO>;
 		ACCOUNT: DurableObjectNamespace<import("./src/index").AccountDO>;
@@ -73,6 +79,9 @@ declare namespace Cloudflare {
 		AUTH_ORIGIN?: "";
 		GOOGLE_CLIENT_ID?: "" | "google-id";
 		GOOGLE_CLIENT_SECRET?: "" | "google-secret";
+		PATREON_CLIENT_ID?: "" | "patreon-id";
+		PATREON_CLIENT_SECRET?: "" | "patreon-secret";
+		PATREON_WEBHOOK_SECRET?: "" | "whsec-test";
 	}
 }
 interface Env extends Cloudflare.Env {}