@voltro/plugin-webhooks 0.85.0 → 0.86.0

package/dist/standardWebhooks.js

@@ -0,0 +1,88 @@
+import { createHmac as e, randomBytes as t, timingSafeEqual as n } from "node:crypto";
+//#region src/standardWebhooks.ts
+var r = "webhook-id", i = "webhook-timestamp", a = "webhook-signature", o = "v1", s = "whsec_", c = 24, l = 64, u = 300, d = () => `${s}${t(32).toString("base64")}`, f = (e) => {
+	if (!e.startsWith("whsec_")) throw Error(`standard-webhooks: the signing secret must be the spec's serialization — "${s}" + base64(24..64 random bytes). Mint one with generateStandardWebhooksSecret(). (A hex secret is also valid base64, so accepting it would sign with the wrong key bytes and every conformant consumer would reject the delivery.)`);
+	let t = Buffer.from(e.slice(6), "base64");
+	if (t.length < 24 || t.length > 64) throw Error(`standard-webhooks: the decoded key is ${t.length} bytes; the spec requires 24..64.`);
+	return t;
+}, p = (e) => e.startsWith(s), m = (e, t) => {
+	if (t.includes(".")) throw Error(`standard-webhooks: the ${e} may not contain "." — it is the field delimiter of the signed content (id.timestamp.payload), and a "." in it makes one signed string readable two ways. Got ${JSON.stringify(t)}.`);
+	if (t.length === 0) throw Error(`standard-webhooks: the ${e} may not be empty`);
+}, h = (e, t, n) => {
+	m("webhook-id", e);
+	let r = String(t);
+	return m("webhook-timestamp", r), Buffer.concat([Buffer.from(`${e}.${r}.`, "utf8"), Buffer.from(n)]);
+}, g = (t, n, r, i) => {
+	let a = e("sha256", f(t));
+	return a.update(h(n, r, i)), `v1,${a.digest("base64")}`;
+}, _ = (e) => {
+	if (e.secrets.length === 0) throw Error("standard-webhooks: at least one signing secret is required");
+	let t = e.secrets.map((t) => g(t, e.messageId, e.timestampSeconds, e.rawBody));
+	return {
+		[r]: e.messageId,
+		[i]: String(e.timestampSeconds),
+		[a]: t.join(" ")
+	};
+}, v = (e, t) => {
+	let r = Buffer.from(e, "utf8"), i = Buffer.from(t, "utf8");
+	return r.length === i.length ? n(r, i) : (n(r, Buffer.alloc(r.length)), !1);
+}, y = (e) => {
+	let t = e.headers, n = t[r], o = t[i], s = t[a];
+	if (!n) return {
+		ok: !1,
+		reason: `missing ${r}`
+	};
+	if (!o) return {
+		ok: !1,
+		reason: `missing ${i}`
+	};
+	if (!s) return {
+		ok: !1,
+		reason: `missing ${a}`
+	};
+	if (n.includes(".")) return {
+		ok: !1,
+		reason: "webhook-id contains the \".\" field delimiter"
+	};
+	let c = Number(o);
+	if (!Number.isInteger(c)) return {
+		ok: !1,
+		reason: `${i} is not an integer unix timestamp`
+	};
+	let l = e.toleranceSeconds ?? 300, u = e.nowSeconds ?? Math.floor(Date.now() / 1e3), d = Math.abs(u - c);
+	if (d > l) return {
+		ok: !1,
+		reason: `timestamp outside the ${l}s tolerance (off by ${d}s)`
+	};
+	let f = s.split(" ").map((e) => e.trim()).filter((e) => e.length > 0);
+	if (f.length === 0) return {
+		ok: !1,
+		reason: "no signature in webhook-signature"
+	};
+	if (f.every((e) => e.startsWith("v1a,"))) return {
+		ok: !1,
+		reason: "only asymmetric (v1a / ed25519) signatures were offered; this verifier implements the symmetric v1 scheme only"
+	};
+	for (let t of e.secrets) {
+		let r;
+		try {
+			r = g(t, n, c, e.rawBody);
+		} catch (e) {
+			return {
+				ok: !1,
+				reason: e.message
+			};
+		}
+		for (let e of f) if (e.startsWith("v1,") && v(r, e)) return {
+			ok: !0,
+			messageId: n,
+			timestampSeconds: c
+		};
+	}
+	return {
+		ok: !1,
+		reason: "signature mismatch"
+	};
+};
+//#endregion
+export { u as STANDARD_WEBHOOKS_DEFAULT_TOLERANCE_SECONDS, r as STANDARD_WEBHOOKS_ID_HEADER, l as STANDARD_WEBHOOKS_MAX_KEY_BYTES, c as STANDARD_WEBHOOKS_MIN_KEY_BYTES, s as STANDARD_WEBHOOKS_SECRET_PREFIX, a as STANDARD_WEBHOOKS_SIGNATURE_HEADER, i as STANDARD_WEBHOOKS_TIMESTAMP_HEADER, o as STANDARD_WEBHOOKS_VERSION, d as generateStandardWebhooksSecret, p as isStandardWebhooksSecret, _ as standardWebhooksHeaders, f as standardWebhooksKey, g as standardWebhooksSignatureToken, h as standardWebhooksSignedContent, y as verifyStandardWebhooks };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-webhooks",
-  "version": "0.85.0",
+  "version": "0.86.0",
   "description": "Webhooks plugin — first-class outgoing (multi-target, durable-workflow delivery, HMAC signing, retry policies, rate limits) + incoming (signature verification, idempotency, provider templates for Stripe / GitHub / Slack / generic).",
   "keywords": [
     "voltro",
@@ -48,12 +48,12 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.85.0",
-    "@voltro/integration-http": "0.85.0",
-    "@voltro/logger": "0.85.0",
-    "@voltro/plugin-multitenancy": "0.85.0",
-    "@voltro/protocol": "0.85.0",
-    "@voltro/runtime": "0.85.0"
+    "@voltro/database": "0.86.0",
+    "@voltro/integration-http": "0.86.0",
+    "@voltro/logger": "0.86.0",
+    "@voltro/plugin-multitenancy": "0.86.0",
+    "@voltro/protocol": "0.86.0",
+    "@voltro/runtime": "0.86.0"
   },
   "peerDependencies": {
     "effect": "4.0.1"

package/dist/signing-DeHObNv6.js

@@ -1,234 +0,0 @@
-import { createHmac as e, randomBytes as t, timingSafeEqual as n } from "node:crypto";
-//#region src/dsl.ts
-var r = (e) => ({
-	_tag: "incomingWebhook",
-	...e
-}), i = (e) => ({
-	_tag: "webhookProvider",
-	...e
-}), a = (e) => {
-	if (typeof e != "object" || !e) return !1;
-	let t = e._tag;
-	return t === "outgoingEvent" || t === "incomingWebhook" || t === "webhookProvider";
-}, o = "webhook-id", s = "webhook-timestamp", c = "webhook-signature", l = "v1", u = "whsec_", d = 24, f = 64, p = 300, m = () => `${u}${t(32).toString("base64")}`, h = (e) => {
-	if (!e.startsWith("whsec_")) throw Error(`standard-webhooks: the signing secret must be the spec's serialization — "${u}" + base64(24..64 random bytes). Mint one with generateStandardWebhooksSecret(). (A hex secret is also valid base64, so accepting it would sign with the wrong key bytes and every conformant consumer would reject the delivery.)`);
-	let t = Buffer.from(e.slice(6), "base64");
-	if (t.length < 24 || t.length > 64) throw Error(`standard-webhooks: the decoded key is ${t.length} bytes; the spec requires 24..64.`);
-	return t;
-}, g = (e) => e.startsWith(u), _ = (e, t) => {
-	if (t.includes(".")) throw Error(`standard-webhooks: the ${e} may not contain "." — it is the field delimiter of the signed content (id.timestamp.payload), and a "." in it makes one signed string readable two ways. Got ${JSON.stringify(t)}.`);
-	if (t.length === 0) throw Error(`standard-webhooks: the ${e} may not be empty`);
-}, v = (e, t, n) => {
-	_("webhook-id", e);
-	let r = String(t);
-	return _("webhook-timestamp", r), Buffer.concat([Buffer.from(`${e}.${r}.`, "utf8"), Buffer.from(n)]);
-}, y = (t, n, r, i) => {
-	let a = e("sha256", h(t));
-	return a.update(v(n, r, i)), `v1,${a.digest("base64")}`;
-}, b = (e) => {
-	if (e.secrets.length === 0) throw Error("standard-webhooks: at least one signing secret is required");
-	let t = e.secrets.map((t) => y(t, e.messageId, e.timestampSeconds, e.rawBody));
-	return {
-		[o]: e.messageId,
-		[s]: String(e.timestampSeconds),
-		[c]: t.join(" ")
-	};
-}, x = (e, t) => {
-	let r = Buffer.from(e, "utf8"), i = Buffer.from(t, "utf8");
-	return r.length === i.length ? n(r, i) : (n(r, Buffer.alloc(r.length)), !1);
-}, S = (e) => {
-	let t = e.headers, n = t[o], r = t[s], i = t[c];
-	if (!n) return {
-		ok: !1,
-		reason: `missing ${o}`
-	};
-	if (!r) return {
-		ok: !1,
-		reason: `missing ${s}`
-	};
-	if (!i) return {
-		ok: !1,
-		reason: `missing ${c}`
-	};
-	if (n.includes(".")) return {
-		ok: !1,
-		reason: "webhook-id contains the \".\" field delimiter"
-	};
-	let a = Number(r);
-	if (!Number.isInteger(a)) return {
-		ok: !1,
-		reason: `${s} is not an integer unix timestamp`
-	};
-	let l = e.toleranceSeconds ?? 300, u = e.nowSeconds ?? Math.floor(Date.now() / 1e3), d = Math.abs(u - a);
-	if (d > l) return {
-		ok: !1,
-		reason: `timestamp outside the ${l}s tolerance (off by ${d}s)`
-	};
-	let f = i.split(" ").map((e) => e.trim()).filter((e) => e.length > 0);
-	if (f.length === 0) return {
-		ok: !1,
-		reason: "no signature in webhook-signature"
-	};
-	if (f.every((e) => e.startsWith("v1a,"))) return {
-		ok: !1,
-		reason: "only asymmetric (v1a / ed25519) signatures were offered; this verifier implements the symmetric v1 scheme only"
-	};
-	for (let t of e.secrets) {
-		let r;
-		try {
-			r = y(t, n, a, e.rawBody);
-		} catch (e) {
-			return {
-				ok: !1,
-				reason: e.message
-			};
-		}
-		for (let e of f) if (e.startsWith("v1,") && x(r, e)) return {
-			ok: !0,
-			messageId: n,
-			timestampSeconds: a
-		};
-	}
-	return {
-		ok: !1,
-		reason: "signature mismatch"
-	};
-}, C = (e) => e === "hmacSha256" ? "sha256" : "sha1", w = (t, n, r, i = "hex") => {
-	let a = e(C(t), n);
-	return a.update(r), a.digest(i);
-};
-function T(e, t) {
-	if (e._tag !== "hmac" || typeof e.header != "string") throw Error(`webhook signing: cannot ${t} with this scheme — expected one of "standardWebhooks" | "hmac" | "custom" with a header, got ${JSON.stringify(e)}`);
-}
-var E = (e, t) => {
-	let n = t.timestampSeconds ?? Math.floor(Date.now() / 1e3);
-	if (e._tag === "standardWebhooks") return {
-		headers: b({
-			secrets: e.previousSecret === void 0 ? [t.secret] : [t.secret, e.previousSecret],
-			messageId: t.messageId,
-			timestampSeconds: n,
-			rawBody: t.rawBody
-		}),
-		timestamp: n
-	};
-	if (e._tag === "custom") return { headers: { [e.header.toLowerCase()]: e.sign(t.rawBody, t.secret) } };
-	T(e, "sign");
-	let r = e.encoding ?? "hex", i = e.versionPrefix ?? "";
-	if (e.includeTimestamp) {
-		let a = Buffer.concat([Buffer.from(`${n}.`, "utf8"), Buffer.from(t.rawBody)]), o = w(e.algorithm, t.secret, a, r);
-		return {
-			headers: { [e.header.toLowerCase()]: `t=${n},${i}${o}` },
-			timestamp: n
-		};
-	}
-	let a = w(e.algorithm, t.secret, t.rawBody, r);
-	return { headers: { [e.header.toLowerCase()]: `${i}${a}` } };
-}, D = (e, t) => {
-	if (e._tag === "standardWebhooks") {
-		let n = S({
-			secrets: e.previousSecret === void 0 ? [t.secret] : [t.secret, e.previousSecret],
-			rawBody: t.rawBody,
-			headers: t.headers,
-			toleranceSeconds: e.toleranceSeconds ?? 300,
-			...t.nowSeconds === void 0 ? {} : { nowSeconds: t.nowSeconds }
-		});
-		return n.ok ? { ok: !0 } : {
-			ok: !1,
-			reason: n.reason
-		};
-	}
-	if (e._tag === "custom") return e.verify(t.rawBody, t.secret, t.headers) ? { ok: !0 } : {
-		ok: !1,
-		reason: "custom verifier rejected"
-	};
-	T(e, "verify");
-	let n = t.headers[e.header.toLowerCase()];
-	if (!n) return {
-		ok: !1,
-		reason: "missing signature header"
-	};
-	let r = e.encoding ?? "hex", i = e.versionPrefix ?? "", a = (a) => {
-		if (e.includeTimestamp) {
-			let o = n.split(",").map((e) => e.trim()), s = o.find((e) => e.startsWith("t="));
-			if (!s) return {
-				ok: !1,
-				reason: "no timestamp in signature header"
-			};
-			let c = Number(s.slice(2));
-			if (!Number.isFinite(c)) return {
-				ok: !1,
-				reason: "invalid timestamp"
-			};
-			let l = e.replayWindowSeconds ?? 300, u = t.nowSeconds ?? Math.floor(Date.now() / 1e3);
-			if (Math.abs(u - c) > l) return {
-				ok: !1,
-				reason: `replay window exceeded (${Math.abs(u - c)}s > ${l}s)`
-			};
-			let d = i.length > 0 ? o.find((e) => e.startsWith(i))?.slice(i.length) : o.find((e) => !e.startsWith("t="));
-			if (!d) return {
-				ok: !1,
-				reason: "no signature in header"
-			};
-			let f = Buffer.concat([Buffer.from(`${c}.`, "utf8"), Buffer.from(t.rawBody)]);
-			return O(w(e.algorithm, a, f, r), d) ? { ok: !0 } : {
-				ok: !1,
-				reason: "signature mismatch"
-			};
-		}
-		let o = i.length > 0 && n.startsWith(i) ? n.slice(i.length) : n;
-		return O(w(e.algorithm, a, t.rawBody, r), o) ? { ok: !0 } : {
-			ok: !1,
-			reason: "signature mismatch"
-		};
-	}, o = a(t.secret);
-	if (o.ok) return o;
-	if (e.previousSecret !== void 0) {
-		let t = a(e.previousSecret);
-		if (t.ok) return t;
-	}
-	return o;
-}, O = (e, t) => {
-	let r = Buffer.from(e, "utf8"), i = Buffer.from(t, "utf8");
-	return r.length === i.length ? n(r, i) : (n(r, Buffer.alloc(r.length)), !1);
-}, k = (e = "Stripe-Signature") => ({
-	_tag: "hmac",
-	algorithm: "hmacSha256",
-	header: e,
-	includeTimestamp: !0,
-	replayWindowSeconds: 300,
-	encoding: "hex",
-	versionPrefix: "v1="
-}), A = () => ({
-	_tag: "hmac",
-	algorithm: "hmacSha256",
-	header: "X-Hub-Signature-256",
-	includeTimestamp: !1,
-	encoding: "hex",
-	versionPrefix: "sha256="
-}), j = (e = {}) => ({
-	_tag: "custom",
-	header: "X-Slack-Signature",
-	sign: (e, t) => `v0=${w("hmacSha256", t, `v0:${Math.floor(Date.now() / 1e3)}:${Buffer.from(e).toString("utf8")}`)}`,
-	verify: (t, n, r) => {
-		let i = r["x-slack-signature"], a = r["x-slack-request-timestamp"];
-		if (!i || !a) return !1;
-		let o = Number(a);
-		if (!Number.isFinite(o)) return !1;
-		let s = e.replayWindowSeconds ?? 300;
-		return Math.abs(Math.floor(Date.now() / 1e3) - o) > s ? !1 : O(`v0=${w("hmacSha256", n, `v0:${o}:${Buffer.from(t).toString("utf8")}`)}`, i);
-	}
-}), M = (e = {}) => ({
-	_tag: "standardWebhooks",
-	...e.toleranceSeconds === void 0 ? {} : { toleranceSeconds: e.toleranceSeconds },
-	...e.previousSecret === void 0 ? {} : { previousSecret: e.previousSecret }
-}), N = () => M(), P = () => ({
-	_tag: "hmac",
-	algorithm: "hmacSha256",
-	header: "X-Webhook-Signature",
-	includeTimestamp: !0,
-	replayWindowSeconds: 300,
-	encoding: "hex",
-	versionPrefix: "v1="
-});
-//#endregion
-export { S as C, a as E, v as S, i as T, m as _, j as a, h as b, D as c, f as d, d as f, l as g, s as h, E as i, p as l, c as m, P as n, M as o, u as p, A as r, k as s, N as t, o as u, g as v, r as w, y as x, b as y };