@upstash/qstash 0.1.8 → 0.2.0

package/esm/deps/deno.land/{std@0.161.0/crypto/_wasm_crypto → std@0.163.0/crypto/_wasm}/mod.js

@@ -1,7 +1,7 @@
 // Copyright 2018-2022 the Deno authors. All rights reserved. MIT license.
 export { DigestContext, instantiate as instantiateWasm, } from "./lib/deno_std_wasm_crypto.generated.js";
 /**
- * All cryptographic hash/digest algorithms supported by std/_wasm_crypto.
+ * All cryptographic hash/digest algorithms supported by std/crypto/_wasm.
  *
  * For algorithms that are supported by WebCrypto, the name here must match the
  * one used by WebCrypto. Otherwise we should prefer the formatting used in the

package/esm/deps/deno.land/{std@0.161.0 → std@0.163.0}/crypto/mod.js

@@ -18,7 +18,7 @@
  * @module
  */
 import * as dntShim from "../../../../_dnt.shims.js";
-import { digestAlgorithms as wasmDigestAlgorithms, instantiateWasm, } from "./_wasm_crypto/mod.js";
+import { digestAlgorithms as wasmDigestAlgorithms, instantiateWasm, } from "./_wasm/mod.js";
 import { timingSafeEqual } from "./timing_safe_equal.js";
 import { fnv } from "./_fnv/index.js";
 export { KeyStack } from "./keystack.js";

package/esm/entrypoints/nextjs.js

@@ -35,7 +35,11 @@ export function verifySignature(handler, config) {
         //   req.url!,
         //   `https://${process.env.VERCEL_URL}`,
         // ).href;
-        const isValid = await receiver.verify({ signature, body });
+        const isValid = await receiver.verify({
+            signature,
+            body,
+            clockTolerance: config?.clockTolerance,
+        });
         if (!isValid) {
             res.status(400);
             res.send("Invalid signature");

package/esm/pkg/receiver.js

@@ -70,18 +70,18 @@ export class Receiver {
             throw new SignatureError(`invalid subject: ${p.sub}, want: ${req.url}`);
         }
         const now = Math.floor(Date.now() / 1000);
-        if (now > p.exp) {
+        if (now - (req.clockTolerance ?? 0) > p.exp) {
             console.log({ now, exp: p.exp });
             throw new SignatureError("token has expired");
         }
-        if (now < p.nbf) {
+        if (now - (req.clockTolerance ?? 0) < p.nbf) {
             throw new SignatureError("token is not yet valid");
         }
         const bodyHash = await this.subtleCrypto.digest("SHA-256", typeof req.body === "string"
             ? new TextEncoder().encode(req.body)
             : req.body);
         const padding = new RegExp(/=+$/);
-        if (p.body.replace(padding, "") !=
+        if (p.body.replace(padding, "") !==
             base64Url.encode(bodyHash).replace(padding, "")) {
             throw new SignatureError(`body hash does not match, want: ${p.body}, got: ${base64Url.encode(bodyHash)}`);
         }

package/package.json

@@ -3,7 +3,7 @@
   "main": "./script/entrypoints/nodejs.js",
   "types": "./types/entrypoints/nodejs.d.ts",
   "name": "@upstash/qstash",
-  "version": "v0.1.8",
+  "version": "v0.2.0",
   "description": "Official Deno/Typescript client for QStash",
   "repository": {
     "type": "git",