@voltro/plugin-webhooks 0.85.0 → 0.86.0

package/dist/incoming.js

@@ -0,0 +1,205 @@
+import { verifyRequest as e } from "./signing.js";
+import { getIdempotencyCache as t, parseTtl as n } from "./idempotency.js";
+import { Schema as r } from "effect";
+import { publishServerError as i } from "@voltro/protocol";
+import { createLogger as a } from "@voltro/logger";
+//#region src/incoming.ts
+var o = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), s = "voltroWebhookVerification", c = class extends Error {
+	webhookId;
+	name = "UnverifiedIncomingWebhook";
+	constructor(e) {
+		super(`incoming webhook '${e}' declares no verification. It would be mounted as a public, unauthenticated POST that runs your application code, so the framework refuses to mount it. Pick one on the descriptor:\n  · provider: stripeWebhookProvider()   — a preset (HMAC scheme + idempotency + body type)\n  · signature: { _tag: 'hmac', algorithm: 'hmacSha256', header: 'X-Signature', encoding: 'hex', includeTimestamp: true }\n  · verification: 'provider'            — the handler verifies with the provider's own SDK\n  · verification: 'none'                — deliberately public; a gateway / IP allow-list owns it\nA signature-verified webhook reads its shared secret from VOLTRO_WEBHOOK_SECRET_${e.toUpperCase().replace(/[^A-Z0-9]/g, "_")}. The framework never invents that value — the sender holds the other half of it.`), this.webhookId = e;
+	}
+}, l = (e) => `VOLTRO_WEBHOOK_SECRET_${e.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, u = (e) => {
+	let t = e.signature ?? e.provider?.signature ?? null;
+	return (e.verification === void 0 || e.verification === "signature") && t === null ? null : e.verification ?? "signature";
+}, d = (d, f) => {
+	let p = d.provider, m = d.signature ?? p?.signature ?? null, h = d.idempotency ?? p?.idempotency ?? null, g = d.bodyType ?? p?.bodyType ?? "json", _ = u(d);
+	if (_ === null) throw new c(d.id);
+	let v = _;
+	v === "none" && a({ scope: `webhook:${d.id}` }).warn("incoming webhook mounted WITHOUT verification — anyone who can reach this URL can run its handler", {
+		webhookId: d.id,
+		verification: "none"
+	});
+	let y = f.idempotencyCache ?? t(), b = n(h?.ttl), x = f.log ?? ((e) => {
+		a({ scope: `webhook:${e.webhookId}` }).debug("incoming webhook", {
+			status: e.status,
+			signatureOk: e.signatureOk,
+			idempotency: e.idempotency,
+			durationMs: e.durationMs,
+			...e.errorMessage === void 0 ? {} : { errorMessage: e.errorMessage }
+		});
+	});
+	return Object.assign(async (t) => {
+		let n = Date.now();
+		if (t.method !== "POST") {
+			let e = o(405, {
+				error: "method not allowed",
+				expected: "POST"
+			});
+			return x({
+				webhookId: d.id,
+				status: 405,
+				signatureOk: "skipped",
+				idempotency: "skipped",
+				durationMs: Date.now() - n
+			}), e;
+		}
+		let a = "skipped";
+		if (m !== null && v === "signature") {
+			let r = await f.resolveSecret(d.id);
+			if (r === null) {
+				let e = `no signing secret configured — set ${l(d.id)}`, t = o(503, {
+					error: "webhook not configured",
+					reason: e
+				});
+				return x({
+					webhookId: d.id,
+					status: 503,
+					signatureOk: !1,
+					idempotency: "skipped",
+					durationMs: Date.now() - n,
+					errorMessage: e
+				}), t;
+			}
+			{
+				let i = e(m, {
+					rawBody: t.rawBody,
+					secret: r,
+					headers: t.headers
+				});
+				if (a = i.ok, !i.ok) {
+					let e = o(401, {
+						error: "invalid signature",
+						reason: i.reason
+					});
+					return x({
+						webhookId: d.id,
+						status: 401,
+						signatureOk: !1,
+						idempotency: "skipped",
+						durationMs: Date.now() - n,
+						errorMessage: i.reason
+					}), e;
+				}
+			}
+		}
+		let s;
+		try {
+			if (g === "json") {
+				let e = new TextDecoder().decode(t.rawBody);
+				s = e.length === 0 ? null : JSON.parse(e);
+			} else if (g === "form") {
+				let e = new TextDecoder().decode(t.rawBody), n = new URLSearchParams(e), r = {};
+				for (let [e, t] of n.entries()) r[e] = t;
+				s = r;
+			} else s = t.rawBody;
+		} catch (e) {
+			let t = o(400, {
+				error: "malformed body",
+				reason: e.message
+			});
+			return x({
+				webhookId: d.id,
+				status: 400,
+				signatureOk: a,
+				idempotency: "skipped",
+				durationMs: Date.now() - n,
+				errorMessage: e.message
+			}), t;
+		}
+		let c;
+		try {
+			c = r.decodeUnknownSync(d.payload)(s);
+		} catch (e) {
+			let t = o(422, {
+				error: "schema validation failed",
+				reason: e.message
+			});
+			return x({
+				webhookId: d.id,
+				status: 422,
+				signatureOk: a,
+				idempotency: "skipped",
+				durationMs: Date.now() - n,
+				errorMessage: e.message
+			}), t;
+		}
+		let u, p = "skipped";
+		if (h !== null) {
+			let e = h.from;
+			if (u = typeof e == "string" ? t.headers[e.toLowerCase()] : e(t.headers, t.rawBody), u !== void 0 && u.length > 0) {
+				let e = y.claim(u, b);
+				if (p = e, e === "duplicate") {
+					let e = o(200, {
+						received: !0,
+						duplicate: !0
+					});
+					return x({
+						webhookId: d.id,
+						status: 200,
+						signatureOk: a,
+						idempotency: "duplicate",
+						durationMs: Date.now() - n
+					}), e;
+				}
+				if (e === "inflight") {
+					let e = o(409, {
+						error: "request already in flight",
+						idempotencyKey: u
+					});
+					return x({
+						webhookId: d.id,
+						status: 409,
+						signatureOk: a,
+						idempotency: "inflight",
+						durationMs: Date.now() - n
+					}), e;
+				}
+			}
+		}
+		try {
+			let e = f.resolveWorkflows?.();
+			await d.handler({
+				body: c,
+				rawBody: t.rawBody,
+				headers: t.headers,
+				idempotencyKey: u ?? "",
+				...e ? { workflows: e } : {}
+			}), u !== void 0 && y.commit(u);
+			let r = o(200, { received: !0 });
+			return x({
+				webhookId: d.id,
+				status: 200,
+				signatureOk: a,
+				idempotency: p,
+				durationMs: Date.now() - n
+			}), r;
+		} catch (e) {
+			u !== void 0 && y.release(u);
+			let t = o(500, {
+				error: "handler threw",
+				reason: e.message
+			});
+			return x({
+				webhookId: d.id,
+				status: 500,
+				signatureOk: a,
+				idempotency: p,
+				durationMs: Date.now() - n,
+				errorMessage: e.message
+			}), i({
+				error: e,
+				source: "webhook",
+				name: d.id,
+				fields: { status: 500 }
+			}), t;
+		}
+	}, { [s]: v });
+}, f = (e) => `/webhooks/${e}`;
+//#endregion
+export { c as UnverifiedIncomingWebhook, s as WEBHOOK_VERIFICATION_PROPERTY, f as defaultIncomingPath, u as incomingWebhookVerification, d as mountIncomingWebhook };