cabloy 5.1.122 → 5.1.124

package/vona/src/suite-vendor/a-pay/modules/a-pay/test/webhook.test.ts

@@ -0,0 +1,278 @@
+import assert from 'node:assert';
+import { createHmac, randomUUID } from 'node:crypto';
+import { describe, it } from 'node:test';
+import { app } from 'vona-mock';
+
+interface IFixture {
+  userId?: number;
+  paymentSessionId?: number;
+}
+
+async function createFixture(suffix: string): Promise<IFixture> {
+  const scope = app.scope('a-pay');
+  const user = await app.bean.user.register({ name: `pay-webhook-${suffix}` }, true);
+  const session = await scope.service.paymentSession.create({
+    userId: user.id,
+    payScene: 'commerce-payment:commerceOrder',
+    businessReference: `business-${suffix}`,
+    amountMinor: 1299,
+    currency: 'USD',
+    correlationId: `payment-${suffix}`,
+  });
+  return { userId: user.id as number, paymentSessionId: session.id as number };
+}
+
+async function cleanup(fixture: IFixture) {
+  const scope = app.scope('a-pay');
+  if (fixture.paymentSessionId !== undefined) {
+    await scope.model.outboxEvent.delete({ paymentSessionId: fixture.paymentSessionId });
+    await scope.model.paymentAudit.delete({ paymentSessionId: fixture.paymentSessionId });
+    await scope.model.webhookInbox.delete({ paymentSessionId: fixture.paymentSessionId });
+    await scope.model.paymentSession.delete({ id: fixture.paymentSessionId });
+  }
+  if (fixture.userId !== undefined) {
+    await app.scope('home-user').model.roleUser.delete({ userId: fixture.userId });
+    await app.bean.user.removeById(fixture.userId);
+  }
+}
+
+function createRawBody(
+  fixture: IFixture,
+  suffix: string,
+  state: 'succeeded' | 'failed' | 'cancelled' = 'succeeded',
+  options?: { eventId?: string; providerPaymentId?: string; providerCaptureId?: string },
+) {
+  return JSON.stringify({
+    state,
+    amountMinor: 1299,
+    eventType: `payment.${state}`,
+    paymentSessionId: String(fixture.paymentSessionId),
+    eventId: options?.eventId ?? `mock-${suffix}`,
+    providerPaymentId: options?.providerPaymentId ?? `payment-${suffix}`,
+    providerCaptureId: options?.providerCaptureId ?? `capture-${suffix}`,
+    currency: 'USD',
+  });
+}
+
+function createCommand(rawBody: string) {
+  const body = JSON.parse(rawBody);
+  return {
+    providerName: 'pay-mock:mock',
+    clientName: 'default',
+    environment: 'sandbox' as const,
+    rawBody,
+    verified: {
+      eventId: body.eventId,
+      eventType: body.eventType,
+      paymentSessionId: body.paymentSessionId,
+      payment: {
+        state: body.state,
+        providerPaymentId: body.providerPaymentId,
+        providerCaptureId: body.providerCaptureId,
+      },
+      summary: {
+        amountMinor: body.amountMinor,
+        currency: body.currency,
+      },
+    },
+  };
+}
+
+function sign(rawBody: string, clientName: 'default' | 'secondary' = 'default') {
+  const options = app.bean.payProvider.getOptions('pay-mock:mock', clientName);
+  assert.equal(typeof options.secretWebhook, 'string');
+  return createHmac('sha256', options.secretWebhook).update(rawBody).digest('hex');
+}
+
+function webhookUrl(providerName = 'pay-mock:mock', clientName = 'default') {
+  const url = app.util.getAbsoluteUrlByApiPath(`/pay/webhook/${providerName}/${clientName}`);
+  return url.startsWith('http') ? url : `http://127.0.0.1:${app.config.server.listen.port}${url}`;
+}
+
+async function countFacts(paymentSessionId: number) {
+  const scope = app.scope('a-pay');
+  const [inboxes, audits, outbox] = await Promise.all([
+    scope.model.webhookInbox.select({ where: { paymentSessionId } }),
+    scope.model.paymentAudit.select({ where: { paymentSessionId } }),
+    scope.model.outboxEvent.select({ where: { paymentSessionId } }),
+  ]);
+  return { inboxes, audits, outbox };
+}
+
+describe('webhook.test.ts', { concurrency: false, sequential: true }, () => {
+  it('accepts a raw-body signed HTTP webhook and rejects an invalid signature without mutation', async () => {
+    const fixture: IFixture = {};
+    try {
+      await app.bean.executor.mockCtx(async () => {
+        Object.assign(fixture, await createFixture(randomUUID().slice(0, 12)));
+      });
+      const rawBody = createRawBody(fixture, randomUUID().slice(0, 12));
+      const url = webhookUrl();
+      const invalid = await fetch(url, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'x-pay-mock-signature': 'invalid',
+        },
+        body: rawBody,
+      });
+      assert.equal(invalid.status, 401, await invalid.text());
+      await app.bean.executor.mockCtx(async () => {
+        assert.deepEqual(await countFacts(fixture.paymentSessionId!), {
+          inboxes: [],
+          audits: [],
+          outbox: [],
+        });
+      });
+      const valid = await fetch(url, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'x-pay-mock-signature': sign(rawBody),
+        },
+        body: rawBody,
+      });
+      assert.equal(valid.status, 200);
+      await app.bean.executor.mockCtx(async () => {
+        const session = await app
+          .scope('a-pay')
+          .model.paymentSession.getById(fixture.paymentSessionId!);
+        const facts = await countFacts(fixture.paymentSessionId!);
+        assert.equal(session?.state, 'succeeded');
+        assert.deepEqual(
+          [facts.inboxes.length, facts.audits.length, facts.outbox.length],
+          [1, 1, 1],
+        );
+      });
+    } finally {
+      await app.bean.executor.mockCtx(async () => await cleanup(fixture));
+    }
+  });
+
+  it('uses the route client webhook secret and preserves session client binding', async () => {
+    const fixture: IFixture = {};
+    try {
+      await app.bean.executor.mockCtx(async () => {
+        Object.assign(fixture, await createFixture(randomUUID().slice(0, 12)));
+      });
+      const rawBody = createRawBody(fixture, randomUUID().slice(0, 12));
+      const url = webhookUrl('pay-mock:mock', 'secondary');
+      const wrongClient = await fetch(url, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'x-pay-mock-signature': sign(rawBody, 'default'),
+        },
+        body: rawBody,
+      });
+      assert.equal(wrongClient.status, 401, await wrongClient.text());
+      const selectedClient = await fetch(url, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'x-pay-mock-signature': sign(rawBody, 'secondary'),
+        },
+        body: rawBody,
+      });
+      assert.equal(selectedClient.status, 409, await selectedClient.text());
+      await app.bean.executor.mockCtx(async () => {
+        assert.deepEqual(await countFacts(fixture.paymentSessionId!), {
+          inboxes: [],
+          audits: [],
+          outbox: [],
+        });
+      });
+    } finally {
+      await app.bean.executor.mockCtx(async () => await cleanup(fixture));
+    }
+  });
+
+  it('persists one verified payment fact and one logical outbox event across replay', async () => {
+    await app.bean.executor.mockCtx(async () => {
+      const fixture = await createFixture(randomUUID().slice(0, 12));
+      try {
+        const rawBody = createRawBody(fixture, randomUUID().slice(0, 12));
+        const first = await app.scope('a-pay').service.webhook.receive(createCommand(rawBody));
+        const replay = await app.scope('a-pay').service.webhook.receive(createCommand(rawBody));
+        assert.equal(replay.id, first.id);
+        assert.equal(replay.state, 'processed');
+        const session = await app
+          .scope('a-pay')
+          .model.paymentSession.getById(fixture.paymentSessionId!);
+        const facts = await countFacts(fixture.paymentSessionId!);
+        assert.equal(session?.state, 'succeeded');
+        assert.deepEqual(
+          [facts.inboxes.length, facts.audits.length, facts.outbox.length],
+          [1, 1, 1],
+        );
+        assert.equal(facts.outbox[0]?.eventType, 'payment.outcome.v1');
+      } finally {
+        await cleanup(fixture);
+      }
+    });
+  });
+
+  it('converges concurrent duplicate and out-of-order terminal webhooks on the first terminal state', async () => {
+    const fixture: IFixture = {};
+    try {
+      await app.bean.executor.mockCtx(async () => {
+        Object.assign(fixture, await createFixture(randomUUID().slice(0, 12)));
+      });
+      const rawBody = createRawBody(fixture, randomUUID().slice(0, 12));
+      const receive = async () => {
+        return await app.bean.executor.mockCtx(async () => {
+          return await app.scope('a-pay').service.webhook.receive(createCommand(rawBody));
+        });
+      };
+      const results = await Promise.allSettled([receive(), receive()]);
+      assert.equal(
+        results.filter(result => result.status === 'fulfilled').length,
+        2,
+        JSON.stringify(results),
+      );
+      await app.bean.executor.mockCtx(async () => {
+        const failedRawBody = createRawBody(fixture, randomUUID().slice(0, 12), 'failed');
+        const ignored = await app
+          .scope('a-pay')
+          .service.webhook.receive(createCommand(failedRawBody));
+        const session = await app
+          .scope('a-pay')
+          .model.paymentSession.getById(fixture.paymentSessionId!);
+        const facts = await countFacts(fixture.paymentSessionId!);
+        assert.equal(session?.state, 'succeeded');
+        assert.equal(ignored.state, 'processed');
+        assert.match(ignored.errorSummary ?? '', /ignored after succeeded/);
+        assert.deepEqual(
+          [facts.inboxes.length, facts.audits.length, facts.outbox.length],
+          [2, 1, 1],
+        );
+      });
+    } finally {
+      await app.bean.executor.mockCtx(async () => await cleanup(fixture));
+    }
+  });
+
+  it('rejects a same-state webhook with conflicting provider facts', async () => {
+    await app.bean.executor.mockCtx(async () => {
+      const fixture = await createFixture(randomUUID().slice(0, 12));
+      try {
+        const first = createRawBody(fixture, randomUUID().slice(0, 12));
+        await app.scope('a-pay').service.webhook.receive(createCommand(first));
+        const conflict = createRawBody(fixture, randomUUID().slice(0, 12), 'succeeded', {
+          providerCaptureId: `other-capture-${randomUUID().slice(0, 12)}`,
+        });
+        await assert.rejects(
+          app.scope('a-pay').service.webhook.receive(createCommand(conflict)),
+          (error: any) => error.code === 409,
+        );
+        const facts = await countFacts(fixture.paymentSessionId!);
+        assert.deepEqual(
+          [facts.inboxes.length, facts.audits.length, facts.outbox.length],
+          [1, 1, 1],
+        );
+      } finally {
+        await cleanup(fixture);
+      }
+    });
+  });
+});

package/vona/src/suite-vendor/a-pay/modules/a-pay/tsconfig.build.json

@@ -0,0 +1,11 @@
+{
+  "extends": "../../tsconfig.base",
+  "compilerOptions": {
+    "rootDir": "src",
+    "declaration": true,
+    "declarationMap": true,
+    "emitDeclarationOnly": true,
+    "outDir": "dist"
+  },
+  "include": ["src", "src/.metadata/*.ts", "src/**/*.json"]
+}

package/vona/src/suite-vendor/a-pay/modules/a-pay/tsconfig.json

@@ -0,0 +1,7 @@
+{
+  "extends": "../../tsconfig.base",
+  "compilerOptions": {
+    "noEmit": true
+  },
+  "include": ["src", "src/.metadata/*.ts", "src/**/*.json", "test"]
+}

package/vona/src/suite-vendor/a-pay/modules/pay-mock/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "vona-module-pay-mock",
+  "version": "5.0.1",
+  "description": "",
+  "keywords": [
+    "Vona Module"
+  ],
+  "author": "",
+  "files": [
+    "assets",
+    "dist",
+    "src"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": [
+        "./src/index.ts",
+        "./dist/index.d.ts"
+      ],
+      "import": "./src/index.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "clean": "rimraf dist tsconfig.build.tsbuildinfo",
+    "tsc:publish": "npm run clean && node ../../../../../packages-cli/cli/src/bin/vona.ts :bin:buildModule --sourcemap && tsc -p tsconfig.build.json",
+    "prepublishOnly": "npm run tsc:publish",
+    "prepack": "clean-package",
+    "postpack": "clean-package restore"
+  },
+  "dependencies": {
+    "vona-module-a-pay": "workspace:*"
+  },
+  "devDependencies": {
+    "clean-package": "^2.2.0",
+    "rimraf": "^6.1.3"
+  },
+  "clean-package": {
+    "indent": 2,
+    "remove": [
+      "clean-package",
+      "devDependencies",
+      "exports.\\..import"
+    ]
+  },
+  "title": "pay-mock",
+  "vonaModule": {
+    "dependencies": {
+      "a-pay": "5.0.0",
+      "a-vona": "5.0.0"
+    }
+  }
+}

package/vona/src/suite-vendor/a-pay/modules/pay-mock/src/.metadata/index.ts

@@ -0,0 +1,182 @@
+// eslint-disable
+import type { TypeSymbolKeyFieldsMore } from 'vona-module-a-orm';
+import type { TypeEntityOptionsFields,TypeControllerOptionsActions } from 'vona-module-a-openapi';
+/** service: begin */
+export * from '../service/payMock.ts';
+
+import 'vona-module-a-bean';
+declare module 'vona-module-a-bean' {
+
+    export interface IServiceRecord {
+      'pay-mock:payMock': never;
+    }
+
+
+}
+declare module 'vona-module-pay-mock' {
+
+        export interface ServicePayMock {
+          /** @internal */
+          get scope(): ScopeModulePayMock;
+        }
+
+          export interface ServicePayMock {
+            get $beanFullName(): 'pay-mock.service.payMock';
+            get $onionName(): 'pay-mock:payMock';
+
+          }
+}
+/** service: end */
+/** service: begin */
+import type { ServicePayMock } from '../service/payMock.ts';
+export interface IModuleService {
+  'payMock': ServicePayMock;
+}
+/** service: end */
+/** service: begin */
+
+import 'vona';
+declare module 'vona' {
+  export interface IBeanRecordGeneral {
+    'pay-mock.service.payMock': ServicePayMock;
+  }
+}
+/** service: end */
+/** dto: begin */
+export * from '../dto/mockPaymentComplete.tsx';
+export * from '../dto/mockPaymentReceipt.tsx';
+import type { IDtoOptionsMockPaymentComplete } from '../dto/mockPaymentComplete.tsx';
+import type { IDtoOptionsMockPaymentReceipt } from '../dto/mockPaymentReceipt.tsx';
+import 'vona-module-a-web';
+declare module 'vona-module-a-web' {
+
+    export interface IDtoRecord {
+      'pay-mock:mockPaymentComplete': IDtoOptionsMockPaymentComplete;
+'pay-mock:mockPaymentReceipt': IDtoOptionsMockPaymentReceipt;
+    }
+
+
+}
+declare module 'vona-module-pay-mock' {
+
+}
+/** dto: end */
+/** dto: begin */
+import type { DtoMockPaymentComplete } from '../dto/mockPaymentComplete.tsx';
+import type { DtoMockPaymentReceipt } from '../dto/mockPaymentReceipt.tsx';
+declare module 'vona-module-pay-mock' {
+
+    export interface IDtoOptionsMockPaymentComplete {
+      fields?: TypeEntityOptionsFields<DtoMockPaymentComplete, IDtoOptionsMockPaymentComplete[TypeSymbolKeyFieldsMore]>;
+    }
+
+    export interface IDtoOptionsMockPaymentReceipt {
+      fields?: TypeEntityOptionsFields<DtoMockPaymentReceipt, IDtoOptionsMockPaymentReceipt[TypeSymbolKeyFieldsMore]>;
+    }
+}
+/** dto: end */
+/** controller: begin */
+export * from '../controller/mockPayment.ts';
+import type { IControllerOptionsMockPayment } from '../controller/mockPayment.ts';
+import 'vona-module-a-web';
+declare module 'vona-module-a-web' {
+
+    export interface IControllerRecord {
+      'pay-mock:mockPayment': IControllerOptionsMockPayment;
+    }
+
+
+}
+declare module 'vona-module-pay-mock' {
+
+        export interface ControllerMockPayment {
+          /** @internal */
+          get scope(): ScopeModulePayMock;
+        }
+
+          export interface ControllerMockPayment {
+            get $beanFullName(): 'pay-mock.controller.mockPayment';
+            get $onionName(): 'pay-mock:mockPayment';
+            get $onionOptions(): IControllerOptionsMockPayment;
+          }
+}
+/** controller: end */
+/** controller: begin */
+// @ts-ignore ignore
+import type { ControllerMockPayment } from '../controller/mockPayment.ts';
+declare module 'vona-module-pay-mock' {
+
+    export interface IControllerOptionsMockPayment {
+      actions?: TypeControllerOptionsActions<ControllerMockPayment>;
+    }
+}
+declare module 'vona-module-a-web' {
+  export interface IApiPathPostRecord{
+        '/pay/mock/payment-session/:id/complete': undefined;
+    }
+
+}
+
+/** controller: end */
+/** payProvider: begin */
+export * from '../bean/payProvider.mock.ts';
+import type { IPayProviderOptionsMock } from '../bean/payProvider.mock.ts';
+import 'vona-module-a-pay';
+declare module 'vona-module-a-pay' {
+
+    export interface IPayProviderRecord {
+      'pay-mock:mock': IPayProviderOptionsMock;
+    }
+
+
+}
+declare module 'vona-module-pay-mock' {
+
+        export interface PayProviderMock {
+          /** @internal */
+          get scope(): ScopeModulePayMock;
+        }
+
+          export interface PayProviderMock {
+            get $beanFullName(): 'pay-mock.payProvider.mock';
+            get $onionName(): 'pay-mock:mock';
+            get $onionOptions(): IPayProviderOptionsMock;
+          }
+}
+/** payProvider: end */
+/** payProvider: begin */
+import type { PayProviderMock } from '../bean/payProvider.mock.ts';
+export interface IModulePayProvider {
+  'mock': PayProviderMock;
+}
+/** payProvider: end */
+/** scope: begin */
+import { BeanScopeBase, type BeanScopeUtil } from 'vona';
+import { Scope } from 'vona-module-a-bean';
+
+@Scope()
+export class ScopeModulePayMock extends BeanScopeBase {}
+
+export interface ScopeModulePayMock {
+  util: BeanScopeUtil;
+service: IModuleService;
+payProvider: IModulePayProvider;
+}
+
+import 'vona';
+declare module 'vona' {
+  export interface IBeanScopeRecord {
+    'pay-mock': ScopeModulePayMock;
+  }
+
+  export interface IBeanScopeContainer {
+    payMock: ScopeModulePayMock;
+  }
+
+
+
+
+
+
+}
+/** scope: end */

package/vona/src/suite-vendor/a-pay/modules/pay-mock/src/.metadata/this.ts

@@ -0,0 +1,2 @@
+export const __ThisModule__ = 'pay-mock';
+export { ScopeModulePayMock as ScopeModule } from './index.ts';

package/vona/src/suite-vendor/a-pay/modules/pay-mock/src/bean/payProvider.mock.ts

@@ -0,0 +1,149 @@
+import type {
+  IDecoratorPayProviderOptions,
+  IPayProviderClientOptions,
+  IPayProviderClientRecord,
+  IPayProviderExecute,
+  IPayProviderPaymentInput,
+  IPayProviderPaymentSnapshot,
+  IPayProviderRefundInput,
+  IPayProviderRefundSnapshot,
+  IPayProviderVerifiedWebhook,
+  IPayProviderWebhookInput,
+} from 'vona-module-a-pay';
+
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { BeanBase, useApp } from 'vona';
+import { PayProvider } from 'vona-module-a-pay';
+import { z } from 'zod';
+
+const WebhookBodySchema = z.object({
+  eventId: z.string().min(1).max(255),
+  eventType: z.enum(['payment.succeeded', 'payment.failed', 'payment.cancelled']),
+  paymentSessionId: z.string().min(1),
+  state: z.enum(['succeeded', 'failed', 'cancelled']),
+  amountMinor: z.number().int().nonnegative(),
+  currency: z.string().length(3),
+  providerPaymentId: z.string().min(1).max(255).optional(),
+  providerCaptureId: z.string().min(1).max(255).optional(),
+});
+
+export interface IPayProviderMockClientRecord extends IPayProviderClientRecord {
+  secondary: never;
+}
+
+export interface IPayProviderMockClientOptions extends IPayProviderClientOptions {
+  secretCredential: string | undefined;
+  secretWebhook: string | undefined;
+}
+
+const app = useApp();
+
+export interface IPayProviderOptionsMock extends IDecoratorPayProviderOptions<
+  IPayProviderMockClientRecord,
+  IPayProviderMockClientOptions
+> {}
+
+@PayProvider<IPayProviderOptionsMock>({
+  base: {
+    capabilities: {
+      redirectCheckout: false,
+      embeddedCheckout: true,
+      automaticCapture: true,
+      manualCapture: false,
+      refunds: true,
+      partialRefunds: true,
+      webhooks: true,
+    },
+  },
+  clients: {
+    default: {
+      environment: 'sandbox',
+      secretCredential: app.meta.env.PAY_MOCK_DEFAULT_CREDENTIAL,
+      secretWebhook: app.meta.env.PAY_MOCK_DEFAULT_WEBHOOK,
+    },
+    secondary: {
+      environment: 'sandbox',
+      secretCredential: app.meta.env.PAY_MOCK_SECONDARY_CREDENTIAL,
+      secretWebhook: app.meta.env.PAY_MOCK_SECONDARY_WEBHOOK,
+    },
+  },
+})
+export class PayProviderMock
+  extends BeanBase
+  implements IPayProviderExecute<IPayProviderMockClientOptions>
+{
+  async startPayment(
+    input: IPayProviderPaymentInput,
+    _clientOptions: IPayProviderMockClientOptions,
+  ): Promise<IPayProviderPaymentSnapshot> {
+    return {
+      state: 'requires_action',
+      providerPaymentId: `mock-payment-${input.paymentSessionId}`,
+      nextAction: { kind: 'pending' },
+    };
+  }
+
+  async queryPayment(
+    input: IPayProviderPaymentInput,
+    _clientOptions: IPayProviderMockClientOptions,
+  ): Promise<IPayProviderPaymentSnapshot> {
+    return {
+      state: 'processing',
+      providerPaymentId: `mock-payment-${input.paymentSessionId}`,
+    };
+  }
+
+  async createRefund(
+    input: IPayProviderRefundInput,
+    _clientOptions: IPayProviderMockClientOptions,
+  ): Promise<IPayProviderRefundSnapshot> {
+    return {
+      state: 'pending',
+      providerRefundId: `mock-refund-${input.refundOperationId}`,
+    };
+  }
+
+  async verifyWebhook(
+    input: IPayProviderWebhookInput,
+    clientOptions: IPayProviderMockClientOptions,
+  ): Promise<IPayProviderVerifiedWebhook> {
+    const signature = input.headers['x-pay-mock-signature'];
+    const actual = Array.isArray(signature) ? signature[0] : signature;
+    const secret = clientOptions.secretWebhook;
+    const rawBody = input.rawBody;
+    const expected =
+      typeof secret === 'string' && secret && rawBody !== undefined
+        ? createHmac('sha256', secret).update(rawBody).digest('hex')
+        : undefined;
+    if (!expected || !actual || !safeEqual(actual, expected)) {
+      this.app.throw(401, 'mock webhook signature is invalid');
+    }
+    const body = WebhookBodySchema.safeParse(input.body);
+    if (!body.success) this.app.throw(400, 'mock webhook is invalid');
+    const eventType = `payment.${body.data.state}`;
+    if (body.data.eventType !== eventType)
+      this.app.throw(400, 'mock webhook event type is invalid');
+    return {
+      eventId: body.data.eventId,
+      eventType,
+      paymentSessionId: body.data.paymentSessionId,
+      payment: {
+        state: body.data.state,
+        providerPaymentId: body.data.providerPaymentId,
+        providerCaptureId: body.data.providerCaptureId,
+      },
+      summary: {
+        amountMinor: body.data.amountMinor,
+        currency: body.data.currency,
+      },
+    };
+  }
+}
+
+function safeEqual(actual: string, expected: string) {
+  const actualBuffer = Buffer.from(actual);
+  const expectedBuffer = Buffer.from(expected);
+  return (
+    actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer)
+  );
+}