@zentto/platform-client 0.2.0 → 0.4.0

package/dist/webhooks/index.js

@@ -0,0 +1,57 @@
+/**
+ * Helpers para consumir webhooks firmados por Zentto.
+ *
+ * Cuando Zentto dispara un webhook, incluye el header
+ * `X-Zentto-Signature: sha256=<hmac>` donde el HMAC es:
+ *
+ *   hmacSha256(secretHash, rawBody)
+ *
+ * Nota importante: el firmado se hace con el **secretHash** (lo que Zentto
+ * guarda en BD), NO con el secret plain que el admin vio al crear el webhook.
+ * El secret plain se mantiene como identificador opaco para la UI del admin;
+ * la verificación HMAC usa el hash. Esta nota aplica porque el SDK necesita
+ * que el caller sepa cuál usar.
+ *
+ * Uso típico (Express):
+ *
+ *   app.post("/incoming", bodyParser.raw({ type: "application/json" }), (req, res) => {
+ *     const sig = req.headers["x-zentto-signature"];
+ *     const raw = req.body.toString("utf-8");
+ *     if (!verifySignature(raw, sig, WEBHOOK_SECRET_HASH)) return res.status(401).end();
+ *     const envelope = JSON.parse(raw);
+ *     // procesar envelope.eventType, envelope.data, ...
+ *   });
+ */
+import crypto from "node:crypto";
+/**
+ * Verifica que el header `X-Zentto-Signature` matchee el HMAC-SHA256 del
+ * body crudo con la clave dada. Usa `timingSafeEqual` para prevenir timing
+ * attacks.
+ *
+ * @param rawBody   string UTF-8 del body del POST (NO el parseado JSON).
+ * @param signature valor del header X-Zentto-Signature (formato "sha256=<hex>").
+ * @param key       secret o secretHash según convención del publisher.
+ */
+export function verifySignature(rawBody, signature, key) {
+    if (!signature || Array.isArray(signature) || !key)
+        return false;
+    const match = signature.match(/^sha256=([0-9a-f]{64})$/i);
+    if (!match)
+        return false;
+    const expected = crypto.createHmac("sha256", key).update(rawBody).digest();
+    const received = Buffer.from(match[1], "hex");
+    if (expected.length !== received.length)
+        return false;
+    try {
+        return crypto.timingSafeEqual(expected, received);
+    }
+    catch {
+        return false;
+    }
+}
+/** Firma un body con la misma convención (útil para tests y mocks). */
+export function signBody(rawBody, key) {
+    const hmac = crypto.createHmac("sha256", key).update(rawBody).digest("hex");
+    return `sha256=${hmac}`;
+}
+//# sourceMappingURL=index.js.map

package/dist/webhooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,SAAwC,EACxC,GAAW;IAEX,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACjE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,GAAW;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,OAAO,UAAU,IAAI,EAAE,CAAC;AAC1B,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zentto/platform-client",
-  "version": "0.2.0",
-  "description": "Cliente tipado para los servicios de plataforma Zentto (notify, cache, auth, landing). Uso oficial en ERP, verticals y sitios de tenants clientes.",
+  "version": "0.4.0",
+  "description": "Cliente tipado para los servicios de plataforma Zentto (notify, auth, cache, landing, events, webhooks). Uso oficial en ERP, verticals y sitios de tenants clientes.",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -25,8 +25,22 @@
     "./landing": {
       "types": "./dist/landing/index.d.ts",
       "import": "./dist/landing/index.js"
+    },
+    "./events": {
+      "types": "./dist/events/index.d.ts",
+      "import": "./dist/events/index.js"
+    },
+    "./webhooks": {
+      "types": "./dist/webhooks/index.d.ts",
+      "import": "./dist/webhooks/index.js"
     }
   },
+  "peerDependenciesMeta": {
+    "kafkajs": { "optional": true }
+  },
+  "peerDependencies": {
+    "kafkajs": "^2.2.4"
+  },
   "files": [
     "dist",
     "README.md",
@@ -35,6 +49,8 @@
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "clean": "rm -rf dist",
     "prepublishOnly": "npm run clean && npm run build"
   },
@@ -59,7 +75,8 @@
   },
   "devDependencies": {
     "@types/node": "^25.6.0",
-    "typescript": "^5.7.0"
+    "typescript": "^5.7.0",
+    "vitest": "^3.2.4"
   },
   "engines": {
     "node": ">=20"