@stratum-hq/lib 0.5.0 → 0.6.0

package/dist/webhook-signature.js

@@ -0,0 +1,55 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_WEBHOOK_TOLERANCE_SECONDS = void 0;
+exports.signWebhookPayload = signWebhookPayload;
+exports.verifyWebhookSignature = verifyWebhookSignature;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+/** Default freshness window, in seconds, for a webhook delivery timestamp. */
+exports.DEFAULT_WEBHOOK_TOLERANCE_SECONDS = 300;
+/**
+ * Compute the signature for a webhook delivery.
+ *
+ * The timestamp is bound into the signed value (`<timestamp>.<payload>`), so a
+ * captured delivery cannot be re-sent with a fresh timestamp to slip past the
+ * receiver's freshness check. Producers and {@link verifyWebhookSignature} must
+ * sign over the exact same string.
+ */
+function signWebhookPayload(secret, timestamp, payload) {
+    return ("sha256=" +
+        node_crypto_1.default
+            .createHmac("sha256", secret)
+            .update(`${timestamp}.${payload}`)
+            .digest("hex"));
+}
+/**
+ * Verify a Stratum webhook delivery.
+ *
+ * Returns `true` only when the signature is valid AND the timestamp falls
+ * within the freshness window. The window is the replay defense: it rejects a
+ * captured, still-correctly-signed delivery once it ages out. For strict
+ * exactly-once handling, also de-duplicate on the `X-Stratum-Delivery-ID`
+ * header. The comparison is constant-time and the function never throws.
+ */
+function verifyWebhookSignature(options) {
+    const { secret, payload, signature, timestamp, toleranceSeconds = exports.DEFAULT_WEBHOOK_TOLERANCE_SECONDS, now = Date.now(), } = options;
+    // Reject a missing or malformed timestamp (fail closed).
+    const sentMs = Date.parse(timestamp);
+    if (Number.isNaN(sentMs)) {
+        return false;
+    }
+    // Reject deliveries outside the freshness window in either direction.
+    if (Math.abs(now - sentMs) > toleranceSeconds * 1000) {
+        return false;
+    }
+    const expected = Buffer.from(signWebhookPayload(secret, timestamp, payload));
+    const provided = Buffer.from(signature);
+    // timingSafeEqual requires equal-length inputs; unequal length is a mismatch.
+    if (expected.length !== provided.length) {
+        return false;
+    }
+    return node_crypto_1.default.timingSafeEqual(expected, provided);
+}
+//# sourceMappingURL=webhook-signature.js.map

package/dist/webhook-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-signature.js","sourceRoot":"","sources":["../src/webhook-signature.ts"],"names":[],"mappings":";;;;;;AAaA,gDAYC;AA0BD,wDA4BC;AA/ED,8DAAiC;AAEjC,8EAA8E;AACjE,QAAA,iCAAiC,GAAG,GAAG,CAAC;AAErD;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAChC,MAAc,EACd,SAAiB,EACjB,OAAe;IAEf,OAAO,CACL,SAAS;QACT,qBAAM;aACH,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC5B,MAAM,CAAC,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;aACjC,MAAM,CAAC,KAAK,CAAC,CACjB,CAAC;AACJ,CAAC;AAiBD;;;;;;;;GAQG;AACH,SAAgB,sBAAsB,CAAC,OAA6B;IAClE,MAAM,EACJ,MAAM,EACN,OAAO,EACP,SAAS,EACT,SAAS,EACT,gBAAgB,GAAG,yCAAiC,EACpD,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GACjB,GAAG,OAAO,CAAC;IAEZ,yDAAyD;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,gBAAgB,GAAG,IAAI,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,qBAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACpD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stratum-hq/lib",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Stratum tenant management library - framework-agnostic business logic",
   "keywords": [
     "multi-tenancy",
@@ -36,7 +36,8 @@
   "scripts": {
     "build": "tsc && cp -r src/migrations dist/migrations",
     "test": "vitest run",
-    "lint": "tsc --noEmit",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
     "clean": "rm -rf dist"
   },
   "publishConfig": {