docspring 4.0.0 → 4.2.0

package/dist/WebhookSignature.js

@@ -0,0 +1,86 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.WEBHOOK_SIGNATURE_TOLERANCE = void 0;
+exports.verifyWebhookSignature = verifyWebhookSignature;
+var _crypto = _interopRequireDefault(require("crypto"));
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { "default": e }; }
+function _slicedToArray(r, e) { return _arrayWithHoles(r) || _iterableToArrayLimit(r, e) || _unsupportedIterableToArray(r, e) || _nonIterableRest(); }
+function _nonIterableRest() { throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }
+function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
+function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
+function _iterableToArrayLimit(r, l) { var t = null == r ? null : "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (null != t) { var e, n, i, u, a = [], f = !0, o = !1; try { if (i = (t = t.call(r)).next, 0 === l) { if (Object(t) !== t) return; f = !1; } else for (; !(f = (e = i.call(t)).done) && (a.push(e.value), a.length !== l); f = !0); } catch (r) { o = !0, n = r; } finally { try { if (!f && null != t["return"] && (u = t["return"](), Object(u) !== u)) return; } finally { if (o) throw n; } } return a; } }
+function _arrayWithHoles(r) { if (Array.isArray(r)) return r; }
+/**
+ * Checks webhook requests' X-DocSpring-Signature header (https://docspring.com/docs/webhooks/verifying-signatures/).
+ * @module WebhookSignature
+ */
+
+/**
+ * The number of seconds a webhook request's signature stays valid (verifyWebhookSignature)
+ * @type {Number}
+ */
+var WEBHOOK_SIGNATURE_TOLERANCE = exports.WEBHOOK_SIGNATURE_TOLERANCE = 300;
+
+/**
+ * Checks a webhook request's X-DocSpring-Signature header. Returns true when one of its v1 signatures is the
+ * HMAC-SHA256 of "{t}.{payload}" with the webhook's secret, and its timestamp t is at most `tolerance` seconds from
+ * `now`. Returns false for anything else, including a missing or malformed header.
+ * @param {String|Buffer} payload The request body exactly as it was received (Express: express.raw()), not parsed JSON.
+ * @param {String} signatureHeader The X-DocSpring-Signature header.
+ * @param {String} secret The webhook's signing secret.
+ * @param {Object} [options]
+ * @param {Number} [options.tolerance=300] How many seconds old (or early) the timestamp can be. 5 minutes by default.
+ * @param {Number} [options.now] The current Unix time in seconds, for tests. The system clock by default.
+ * @returns {Boolean}
+ */
+function verifyWebhookSignature(payload, signatureHeader, secret) {
+  var _ref = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : {},
+    _ref$tolerance = _ref.tolerance,
+    tolerance = _ref$tolerance === void 0 ? WEBHOOK_SIGNATURE_TOLERANCE : _ref$tolerance,
+    now = _ref.now;
+  var body;
+  if (typeof payload === 'string') {
+    body = Buffer.from(payload, 'utf8');
+  } else if (payload instanceof Uint8Array) {
+    body = Buffer.from(payload);
+  } else {
+    return false;
+  }
+  if (typeof signatureHeader !== 'string' || typeof secret !== 'string' || secret === '') return false;
+  var parts = signatureHeader.split(',').map(function (part) {
+    var trimmed = part.trim();
+    var separator = trimmed.indexOf('=');
+    return separator === -1 ? [trimmed, ''] : [trimmed.slice(0, separator), trimmed.slice(separator + 1)];
+  });
+  var timestampPart = parts.find(function (_ref2) {
+    var _ref3 = _slicedToArray(_ref2, 1),
+      key = _ref3[0];
+    return key === 't';
+  });
+  var signatures = parts.filter(function (_ref4) {
+    var _ref5 = _slicedToArray(_ref4, 2),
+      key = _ref5[0],
+      value = _ref5[1];
+    return key === 'v1' && value !== '';
+  }).map(function (_ref6) {
+    var _ref7 = _slicedToArray(_ref6, 2),
+      value = _ref7[1];
+    return value;
+  });
+  if (!timestampPart || !/^[0-9]+$/.test(timestampPart[1]) || signatures.length === 0) return false;
+  var timestamp = timestampPart[1];
+  var current = now === undefined || now === null ? Math.floor(Date.now() / 1000) : Number(now);
+  if (Math.abs(current - Number(timestamp)) > tolerance) return false;
+  var hmac = _crypto["default"].createHmac('sha256', secret);
+  hmac.update("".concat(timestamp, "."), 'utf8');
+  hmac.update(body);
+  var expected = Buffer.from(hmac.digest('hex'), 'utf8');
+  // Constant time, so a timing attack can't find a valid signature byte by byte
+  return signatures.some(function (signature) {
+    var actual = Buffer.from(signature, 'utf8');
+    return actual.length === expected.length && _crypto["default"].timingSafeEqual(actual, expected);
+  });
+}