@workos-inc/node 1.4.0 → 1.5.0

package/lib/common/exceptions/index.d.ts

@@ -4,3 +4,4 @@ export { NotFoundException } from './not-found.exception';
 export { UnauthorizedException } from './unauthorized.exception';
 export { UnprocessableEntityException } from './unprocessable-entity.exception';
 export { OauthException } from './oauth.exception';
+export { SignatureVerificationException } from './signature-verification.exception';

package/lib/common/exceptions/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OauthException = exports.UnprocessableEntityException = exports.UnauthorizedException = exports.NotFoundException = exports.NoApiKeyProvidedException = exports.GenericServerException = void 0;
+exports.SignatureVerificationException = exports.OauthException = exports.UnprocessableEntityException = exports.UnauthorizedException = exports.NotFoundException = exports.NoApiKeyProvidedException = exports.GenericServerException = void 0;
 var generic_server_exception_1 = require("./generic-server.exception");
 Object.defineProperty(exports, "GenericServerException", { enumerable: true, get: function () { return generic_server_exception_1.GenericServerException; } });
 var no_api_key_provided_exception_1 = require("./no-api-key-provided.exception");
@@ -13,3 +13,5 @@ var unprocessable_entity_exception_1 = require("./unprocessable-entity.exception
 Object.defineProperty(exports, "UnprocessableEntityException", { enumerable: true, get: function () { return unprocessable_entity_exception_1.UnprocessableEntityException; } });
 var oauth_exception_1 = require("./oauth.exception");
 Object.defineProperty(exports, "OauthException", { enumerable: true, get: function () { return oauth_exception_1.OauthException; } });
+var signature_verification_exception_1 = require("./signature-verification.exception");
+Object.defineProperty(exports, "SignatureVerificationException", { enumerable: true, get: function () { return signature_verification_exception_1.SignatureVerificationException; } });

package/lib/common/exceptions/signature-verification.exception.d.ts

@@ -0,0 +1,4 @@
+export declare class SignatureVerificationException extends Error {
+    readonly name: string;
+    constructor(message: string);
+}

package/lib/common/exceptions/signature-verification.exception.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignatureVerificationException = void 0;
+class SignatureVerificationException extends Error {
+    constructor(message) {
+        super(message || 'Signature verification failed.');
+        this.name = 'SignatureVerificationException';
+    }
+}
+exports.SignatureVerificationException = SignatureVerificationException;

package/lib/index.d.ts

@@ -5,5 +5,6 @@ export * from './directory-sync/interfaces';
 export * from './passwordless/interfaces';
 export * from './portal/interfaces';
 export * from './sso/interfaces';
+export * from './webhooks/interfaces';
 export { WorkOS };
 export default WorkOS;

package/lib/index.js

@@ -19,5 +19,6 @@ __exportStar(require("./directory-sync/interfaces"), exports);
 __exportStar(require("./passwordless/interfaces"), exports);
 __exportStar(require("./portal/interfaces"), exports);
 __exportStar(require("./sso/interfaces"), exports);
+__exportStar(require("./webhooks/interfaces"), exports);
 // tslint:disable-next-line:no-default-export
 exports.default = workos_1.WorkOS;

package/lib/webhooks/fixtures/webhook.json

@@ -0,0 +1 @@
+{ "id": "wh_123", "data": { "id": "directory_user_01FAEAJCR3ZBZ30D8BD1924TVG", "state": "active", "emails": [{ "type": "work", "value": "blair@foo-corp.com", "primary": true }], "idp_id": "00u1e8mutl6wlH3lL4x7", "object": "directory_user", "username": "blair@foo-corp.com", "last_name": "Lunceford", "first_name": "Blair", "directory_id": "directory_01F9M7F68PZP8QXP8G7X5QRHS7", "raw_attributes": { "name": { "givenName": "Blair", "familyName": "Lunceford", "middleName": "Elizabeth", "honorificPrefix": "Ms." }, "title": "Developer Success Engineer", "active": true, "emails": [{ "type": "work", "value": "blair@foo-corp.com", "primary": true }], "groups": [], "locale": "en-US", "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User", "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"], "userName": "blair@foo-corp.com", "addresses": [{ "region": "CO", "primary": true, "locality": "Steamboat Springs", "postalCode": "80487" }], "externalId": "00u1e8mutl6wlH3lL4x7", "displayName": "Blair Lunceford", "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": { "manager": { "value": "2", "displayName": "Kathleen Chung" }, "division": "Engineering", "department": "Customer Success" } } }, "event": "dsync.user.created" }

package/lib/webhooks/interfaces/index.d.ts

@@ -0,0 +1 @@
+export * from './webhook.interface';

package/lib/webhooks/interfaces/index.js

@@ -0,0 +1,13 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./webhook.interface"), exports);

package/lib/webhooks/interfaces/webhook.interface.d.ts

@@ -0,0 +1,5 @@
+export interface Webhook {
+    id: string;
+    event: string;
+    data: Record<string, any>;
+}

package/lib/webhooks/interfaces/webhook.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/webhooks/webhooks.d.ts

@@ -0,0 +1,13 @@
+import { Webhook } from './interfaces/webhook.interface';
+export declare class Webhooks {
+    constructEvent({ payload, sigHeader, secret, tolerance, }: {
+        payload: unknown;
+        sigHeader: string;
+        secret: string;
+        tolerance?: number;
+    }): Webhook;
+    private verifyHeader;
+    private getTimestampAndSignatureHash;
+    private computeSignature;
+    private secureCompare;
+}

package/lib/webhooks/webhooks.js

@@ -0,0 +1,67 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Webhooks = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const exceptions_1 = require("../common/exceptions");
+class Webhooks {
+    constructEvent({ payload, sigHeader, secret, tolerance = 180, }) {
+        const options = { payload, sigHeader, secret, tolerance };
+        this.verifyHeader(options);
+        const webhookPayload = payload;
+        return webhookPayload;
+    }
+    verifyHeader({ payload, sigHeader, secret, tolerance = 180, }) {
+        const [timestamp, signatureHash] = this.getTimestampAndSignatureHash(sigHeader);
+        if (!signatureHash || Object.keys(signatureHash).length === 0) {
+            throw new exceptions_1.SignatureVerificationException('No signature hash found with expected scheme v1');
+        }
+        if (parseInt(timestamp, 10) < Date.now() - tolerance) {
+            throw new exceptions_1.SignatureVerificationException('Timestamp outside the tolerance zone');
+        }
+        const expectedSig = this.computeSignature(timestamp, payload, secret);
+        if (this.secureCompare(expectedSig, signatureHash) === false) {
+            throw new exceptions_1.SignatureVerificationException('Signature hash does not match the expected signature hash for payload');
+        }
+        return true;
+    }
+    getTimestampAndSignatureHash(sigHeader) {
+        const signature = sigHeader;
+        const [t, v1] = signature.split(',');
+        if (typeof t === 'undefined' || typeof v1 === 'undefined') {
+            throw new exceptions_1.SignatureVerificationException('Signature or timestamp missing');
+        }
+        const { 1: timestamp } = t.split('=');
+        const { 1: signatureHash } = v1.split('=');
+        return [timestamp, signatureHash];
+    }
+    computeSignature(timestamp, payload, secret) {
+        const signedPayload = `${timestamp}.${payload}`;
+        const expectedSignature = crypto_1.default
+            .createHmac('sha256', secret)
+            .update(signedPayload)
+            .digest()
+            .toString('hex');
+        return expectedSignature;
+    }
+    secureCompare(stringA, stringB) {
+        const strA = Buffer.from(stringA);
+        const strB = Buffer.from(stringB);
+        if (strA.length !== strB.length) {
+            return false;
+        }
+        if (crypto_1.default.timingSafeEqual) {
+            return crypto_1.default.timingSafeEqual(strA, strB);
+        }
+        const len = strA.length;
+        let result = 0;
+        for (let i = 0; i < len; ++i) {
+            // tslint:disable-next-line:no-bitwise
+            result |= strA[i] ^ strB[i];
+        }
+        return result === 0;
+    }
+}
+exports.Webhooks = Webhooks;

package/lib/webhooks/webhooks.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/webhooks/webhooks.spec.js

@@ -0,0 +1,154 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = __importDefault(require("crypto"));
+const workos_1 = require("../workos");
+const webhook_json_1 = __importDefault(require("./fixtures/webhook.json"));
+const workos = new workos_1.WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU');
+const exceptions_1 = require("../common/exceptions");
+describe('Webhooks', () => {
+    let payload;
+    let secret;
+    let timestamp;
+    let unhashedString;
+    let signatureHash;
+    let expectation;
+    beforeEach(() => {
+        payload = webhook_json_1.default;
+        secret = 'secret';
+        timestamp = Date.now() * 1000;
+        unhashedString = `${timestamp}.${payload}`;
+        signatureHash = crypto_1.default
+            .createHmac('sha256', secret)
+            .update(unhashedString)
+            .digest()
+            .toString('hex');
+        expectation = {
+            id: 'directory_user_01FAEAJCR3ZBZ30D8BD1924TVG',
+            state: 'active',
+            emails: [
+                {
+                    type: 'work',
+                    value: 'blair@foo-corp.com',
+                    primary: true,
+                },
+            ],
+            idp_id: '00u1e8mutl6wlH3lL4x7',
+            object: 'directory_user',
+            username: 'blair@foo-corp.com',
+            last_name: 'Lunceford',
+            first_name: 'Blair',
+            directory_id: 'directory_01F9M7F68PZP8QXP8G7X5QRHS7',
+            raw_attributes: {
+                name: {
+                    givenName: 'Blair',
+                    familyName: 'Lunceford',
+                    middleName: 'Elizabeth',
+                    honorificPrefix: 'Ms.',
+                },
+                title: 'Developer Success Engineer',
+                active: true,
+                emails: [
+                    {
+                        type: 'work',
+                        value: 'blair@foo-corp.com',
+                        primary: true,
+                    },
+                ],
+                groups: [],
+                locale: 'en-US',
+                schemas: [
+                    'urn:ietf:params:scim:schemas:core:2.0:User',
+                    'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User',
+                ],
+                userName: 'blair@foo-corp.com',
+                addresses: [
+                    {
+                        region: 'CO',
+                        primary: true,
+                        locality: 'Steamboat Springs',
+                        postalCode: '80487',
+                    },
+                ],
+                externalId: '00u1e8mutl6wlH3lL4x7',
+                displayName: 'Blair Lunceford',
+                'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User': {
+                    manager: {
+                        value: '2',
+                        displayName: 'Kathleen Chung',
+                    },
+                    division: 'Engineering',
+                    department: 'Customer Success',
+                },
+            },
+        };
+    });
+    describe('constructEvent', () => {
+        describe('with the correct payload, sig_header, and secret', () => {
+            it('returns a webhook event', () => {
+                const sigHeader = `t=${timestamp}, v1=${signatureHash}`;
+                const options = { payload, sigHeader, secret };
+                const webhook = workos.webhooks.constructEvent(options);
+                expect(webhook.data).toEqual(expectation);
+                expect(webhook.event).toEqual('dsync.user.created');
+                expect(webhook.id).toEqual('wh_123');
+            });
+        });
+        describe('with the correct payload, sig_header, secret, and tolerance', () => {
+            it('returns a webhook event', () => {
+                const sigHeader = `t=${timestamp}, v1=${signatureHash}`;
+                const options = { payload, sigHeader, secret, tolerance: 200 };
+                const webhook = workos.webhooks.constructEvent(options);
+                expect(webhook.data).toEqual(expectation);
+                expect(webhook.event).toEqual('dsync.user.created');
+                expect(webhook.id).toEqual('wh_123');
+            });
+        });
+        describe('with an empty header', () => {
+            it('raises an error', () => {
+                const sigHeader = '';
+                const options = { payload, sigHeader, secret };
+                expect(() => workos.webhooks.constructEvent(options)).toThrowError(exceptions_1.SignatureVerificationException);
+            });
+        });
+        describe('with an empty signature hash', () => {
+            it('raises an error', () => {
+                const sigHeader = `t=${timestamp}, v1=`;
+                const options = { payload, sigHeader, secret };
+                expect(() => workos.webhooks.constructEvent(options)).toThrowError(exceptions_1.SignatureVerificationException);
+            });
+        });
+        describe('with an incorrect signature hash', () => {
+            it('raises an error', () => {
+                const sigHeader = `t=${timestamp}, v1=99999`;
+                const options = { payload, sigHeader, secret };
+                expect(() => workos.webhooks.constructEvent(options)).toThrowError(exceptions_1.SignatureVerificationException);
+            });
+        });
+        describe('with an incorrect payload', () => {
+            it('raises an error', () => {
+                const sigHeader = `t=${timestamp}, v1=${signatureHash}`;
+                payload = 'invalid';
+                const options = { payload, sigHeader, secret };
+                expect(() => workos.webhooks.constructEvent(options)).toThrowError(exceptions_1.SignatureVerificationException);
+            });
+        });
+        describe('with an incorrect webhook secret', () => {
+            it('raises an error', () => {
+                const sigHeader = `t=${timestamp}, v1=${signatureHash}`;
+                secret = 'invalid';
+                const options = { payload, sigHeader, secret };
+                expect(() => workos.webhooks.constructEvent(options)).toThrowError(exceptions_1.SignatureVerificationException);
+            });
+        });
+        describe('with a timestamp outside tolerance', () => {
+            it('raises an error', () => {
+                const sigHeader = `t=9999, v1=${signatureHash}`;
+                const options = { payload, sigHeader, secret };
+                expect(() => workos.webhooks.constructEvent(options)).toThrowError(exceptions_1.SignatureVerificationException);
+            });
+        });
+    });
+});

package/lib/workos.d.ts

@@ -6,6 +6,7 @@ import { Organizations } from './organizations/organizations';
 import { Passwordless } from './passwordless/passwordless';
 import { Portal } from './portal/portal';
 import { SSO } from './sso/sso';
+import { Webhooks } from './webhooks/webhooks';
 export declare class WorkOS {
     readonly key?: string | undefined;
     readonly options: WorkOSOptions;
@@ -17,6 +18,7 @@ export declare class WorkOS {
     readonly passwordless: Passwordless;
     readonly portal: Portal;
     readonly sso: SSO;
+    readonly webhooks: Webhooks;
     constructor(key?: string | undefined, options?: WorkOSOptions);
     post(path: string, entity: any, options?: PostOptions): Promise<AxiosResponse>;
     get(path: string, options?: GetOptions): Promise<AxiosResponse>;

package/lib/workos.js

@@ -21,7 +21,8 @@ const organizations_1 = require("./organizations/organizations");
 const passwordless_1 = require("./passwordless/passwordless");
 const portal_1 = require("./portal/portal");
 const sso_1 = require("./sso/sso");
-const VERSION = '1.4.0';
+const webhooks_1 = require("./webhooks/webhooks");
+const VERSION = '1.5.0';
 const DEFAULT_HOSTNAME = 'api.workos.com';
 class WorkOS {
     constructor(key, options = {}) {
@@ -33,6 +34,7 @@ class WorkOS {
         this.passwordless = new passwordless_1.Passwordless(this);
         this.portal = new portal_1.Portal(this);
         this.sso = new sso_1.SSO(this);
+        this.webhooks = new webhooks_1.Webhooks();
         if (!key) {
             this.key = process.env.WORKOS_API_KEY;
             if (!this.key) {

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.4.0",
+  "version": "1.5.0",
   "name": "@workos-inc/node",
   "author": "WorkOS",
   "description": "A Node wrapper for the WorkOS API",
@@ -9,8 +9,8 @@
     "workos"
   ],
   "volta": {
-    "node": "14.17.6",
-    "yarn": "1.22.11"
+    "node": "14.18.1",
+    "yarn": "1.22.15"
   },
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",
@@ -40,14 +40,14 @@
   },
   "devDependencies": {
     "@types/jest": "27.0.2",
-    "@types/node": "14.17.17",
+    "@types/node": "14.17.22",
     "@types/pluralize": "0.0.29",
     "axios-mock-adapter": "1.20.0",
-    "jest": "27.2.1",
+    "jest": "27.2.5",
     "prettier": "2.4.1",
     "supertest": "6.1.6",
     "ts-jest": "27.0.5",
     "tslint": "6.1.3",
-    "typescript": "4.4.3"
+    "typescript": "4.4.4"
   }
 }