homebridge-smartthings-oauth 1.0.66 → 1.0.67-beta.0

package/CHANGELOG.md

@@ -1,6 +1,16 @@
 # Changelog
 All notable changes to this project will be documented in this file.
 
+## [1.0.67-beta.0] - Optional SmartThings webhook signature verification
+
+> Opt-in hardening for the webhook (tunnel) route. SmartThings already signs every inbound webhook POST with an HTTP Signature (RSA-SHA256 over the request body, using its rotating "Padlock CA" certificate), but the plugin previously did not verify it — any host that could reach the public webhook URL could forge device events. This release adds verification behind a new, **off-by-default** flag, so existing setups are unaffected until they opt in.
+
+### Added
+- **`verifyWebhookSignatures` config option** (default `false`). When enabled, every inbound webhook POST must carry a valid SmartThings HTTP signature, a matching body digest, and a recent `Date` (within ±15 minutes) — otherwise it is rejected with **HTTP 401** before any processing. The signed-header set is required to cover `(request-target)`, `digest`, and `date`, so the digest is genuinely bound to the RSA signature. Only known SmartThings lifecycles (`PING`, `CONFIRMATION`, `INSTALL`, `UPDATE`, `UNINSTALL`, `CONFIGURATION`, `EVENT`) are processed; anything else is dropped with **HTTP 400**. Requires an `https` Server URL — if the Server URL is not https, verification stays disabled (with a logged warning) rather than breaking the webhook. The signing certificate is fetched from `key.smartthings.com` (key id validated to a safe path shape) and cached per key id with a size cap and brief negative caching (keys rotate ~monthly). When the flag is off, webhook handling is unchanged.
+
+### Security
+- **Webhook endpoint hardening** (applies regardless of the flag): the inbound body is now capped (oversized POSTs get **HTTP 413**) to protect the public endpoint from memory exhaustion, and the `CONFIRMATION` lifecycle's outbound call is restricted to `https` URLs with no redirects and a timeout, reducing the server-side request forgery surface.
+
 ## [1.0.66] - Samsung Frame & Tizen TV Control + Laundry/Dishwasher Countdown
 
 > Consolidates the `1.0.66-beta.0`–`beta.7` work (see the beta entries below for full detail). Two themes: Samsung **Frame & Tizen TV** control over the local WebSocket (#46), and a working **remaining-time countdown** for Samsung washers, dryers, and dishwashers in Apple Home (#13). Does not include the in-progress air-purifier work (PR #48).

package/config.schema.json

@@ -62,6 +62,13 @@
         "default": 3000,
         "description": "Port for webhook server (only used if Server URL is configured)"
       },
+      "verifyWebhookSignatures": {
+        "title": "Verify SmartThings Webhook Signatures",
+        "type": "boolean",
+        "required": false,
+        "default": false,
+        "description": "When enabled, every inbound webhook POST must carry a valid SmartThings HTTP signature (and a recent timestamp) or it is rejected with HTTP 401. Only applies when an https Server URL is configured; with a non-https URL it stays disabled. Register/confirm your Server URL with SmartThings BEFORE enabling, then confirm real-time updates still work (polling continues either way). Off (default) preserves existing behavior."
+      },
       "GarageDoorMaxPoll": {
         "title": "Garage Door Max Poll",
         "type": "integer",

package/dist/webhook/signatureVerifier.d.ts

@@ -0,0 +1,45 @@
+import { Logger } from 'homebridge';
+import * as http from 'http';
+export declare class SignatureVerifier {
+    private readonly log;
+    private readonly certCache;
+    private readonly inFlight;
+    private readonly negativeCache;
+    constructor(log: Logger);
+    /**
+     * Returns true only if the request carries a valid, fresh SmartThings signature over the
+     * given raw body. Logs a specific reason on failure to aid diagnosis of 401s.
+     */
+    verify(rawBody: Buffer, method: string | undefined, path: string, headers: http.IncomingHttpHeaders): Promise<boolean>;
+    /**
+     * Parses `Authorization: Signature keyId="...",signature="...",headers="...",algorithm="..."`.
+     * Returns null if the scheme is wrong or any required member is missing.
+     */
+    private parseSignatureHeader;
+    /**
+     * Confirms base64(sha256(rawBody)) equals the value in the Digest header.
+     * Accepts both `SHA256=` and `SHA-256=` prefixes.
+     */
+    private verifyDigest;
+    /**
+     * Rejects requests whose Date header is missing, unparseable, or outside the skew tolerance.
+     */
+    private verifyDateFreshness;
+    /**
+     * Builds the signing string from the signed header list, verbatim and in order.
+     * `(request-target)` => "<method> <path>"; every other token => "<name>: <value>".
+     * Returns null if any named header is absent or multi-valued.
+     */
+    private buildSigningString;
+    /**
+     * Returns the PEM cert for a keyId, using a per-keyId cache and de-duplicating concurrent
+     * fetches. keyId rotation is handled implicitly: a new keyId is simply a new cache key.
+     */
+    private getCertificate;
+    private fetchCertificate;
+    private computeExpiry;
+    private rsaVerify;
+    private pruneExpired;
+    private evictIfFull;
+}
+//# sourceMappingURL=signatureVerifier.d.ts.map

package/dist/webhook/signatureVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signatureVerifier.d.ts","sourceRoot":"","sources":["../../src/webhook/signatureVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AA0C7B,qBAAa,iBAAiB;IAKhB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAJhC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6C;IACtE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;gBAE9B,GAAG,EAAE,MAAM;IAExC;;;OAGG;IACU,MAAM,CACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,IAAI,CAAC,mBAAmB,GAChC,OAAO,CAAC,OAAO,CAAC;IAiDnB;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAiC5B;;;OAGG;IACH,OAAO,CAAC,YAAY;IAkBpB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAqB3B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAqB1B;;;OAGG;YACW,cAAc;YAoCd,gBAAgB;IAqB9B,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,SAAS;IAYjB,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,WAAW;CASpB"}

package/dist/webhook/signatureVerifier.js

@@ -0,0 +1,320 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignatureVerifier = void 0;
+const crypto = __importStar(require("crypto"));
+const axios_1 = __importDefault(require("axios"));
+/**
+ * Verifies the IETF HTTP Signature (draft-cavage) that SmartThings attaches to every
+ * inbound webhook POST. SmartThings signs requests with its rotating x.509 "Padlock CA"
+ * certificate (signatureType ST_PADLOCK); the public cert is served at
+ * `https://key.smartthings.com{keyId}` where keyId comes from the Authorization header.
+ *
+ * Every code path is total: any malformed input, fetch failure, or crypto error resolves
+ * to `false` (=> the caller returns 401). Nothing here throws to the request handler.
+ */
+const KEY_HOST = 'https://key.smartthings.com';
+const KEY_FETCH_TIMEOUT_MS = 5000;
+// Hard cap so a cache entry can never outlive this even if validTo parsing misbehaves.
+const CERT_TTL_CAP_MS = 24 * 60 * 60 * 1000;
+// Reject requests whose Date header is outside this window (anti-replay; tolerant of clock skew).
+const DATE_SKEW_TOLERANCE_MS = 15 * 60 * 1000;
+// Bound the cert cache and briefly remember failed fetches so a flood of distinct keyIds
+// can't drive unbounded outbound requests to key.smartthings.com.
+const MAX_CERT_CACHE_ENTRIES = 32;
+const NEGATIVE_CACHE_TTL_MS = 60 * 1000;
+// SmartThings always signs these; require them in the signed set so the digest/date checks
+// are actually bound to the RSA signature rather than self-referential.
+const REQUIRED_SIGNED_HEADERS = ['(request-target)', 'digest', 'date'];
+// keyId is attacker-influenced (it comes from the request header); only allow a safe path shape.
+const KEY_ID_PATTERN = /^\/[A-Za-z0-9._\-/]+$/;
+class SignatureVerifier {
+    constructor(log) {
+        this.log = log;
+        this.certCache = new Map();
+        this.inFlight = new Map();
+        this.negativeCache = new Map();
+    }
+    /**
+     * Returns true only if the request carries a valid, fresh SmartThings signature over the
+     * given raw body. Logs a specific reason on failure to aid diagnosis of 401s.
+     */
+    async verify(rawBody, method, path, headers) {
+        try {
+            const parsed = this.parseSignatureHeader(headers['authorization']);
+            if (!parsed) {
+                this.log.warn('Webhook signature: missing or malformed Authorization signature header');
+                return false;
+            }
+            // The RSA signature only authenticates the headers listed in `headers="..."`. Require the
+            // body-/replay-binding headers to be present, else digest/date are checked but not signed.
+            const signedSet = parsed.headers.map(h => h.toLowerCase());
+            if (!REQUIRED_SIGNED_HEADERS.every(h => signedSet.includes(h))) {
+                this.log.warn('Webhook signature: signed header list must include (request-target), digest, and date');
+                return false;
+            }
+            if (!this.verifyDigest(rawBody, headers['digest'])) {
+                this.log.warn('Webhook signature: body digest mismatch');
+                return false;
+            }
+            if (!this.verifyDateFreshness(headers['date'])) {
+                return false;
+            }
+            const signingString = this.buildSigningString(parsed.headers, method, path, headers);
+            if (signingString === null) {
+                this.log.warn('Webhook signature: could not build signing string (a signed header is missing)');
+                return false;
+            }
+            const certPem = await this.getCertificate(parsed.keyId);
+            if (!certPem) {
+                this.log.warn(`Webhook signature: could not obtain certificate for keyId ${parsed.keyId}`);
+                return false;
+            }
+            if (!this.rsaVerify(signingString, parsed.signature, certPem)) {
+                this.log.warn('Webhook signature: RSA signature verification failed');
+                return false;
+            }
+            return true;
+        }
+        catch (error) {
+            this.log.warn('Webhook signature: unexpected error during verification:', error);
+            return false;
+        }
+    }
+    /**
+     * Parses `Authorization: Signature keyId="...",signature="...",headers="...",algorithm="..."`.
+     * Returns null if the scheme is wrong or any required member is missing.
+     */
+    parseSignatureHeader(authHeader) {
+        if (typeof authHeader !== 'string') {
+            return null;
+        }
+        const trimmed = authHeader.trim();
+        if (!/^signature\s+/i.test(trimmed)) {
+            return null;
+        }
+        const paramStr = trimmed.replace(/^signature\s+/i, '');
+        const params = {};
+        const re = /(\w+)\s*=\s*"([^"]*)"/g;
+        let match;
+        while ((match = re.exec(paramStr)) !== null) {
+            params[match[1].toLowerCase()] = match[2];
+        }
+        const keyId = params['keyid'];
+        const signature = params['signature'];
+        const headers = params['headers'];
+        const algorithm = params['algorithm'];
+        if (!keyId || !signature || !headers || !algorithm) {
+            return null;
+        }
+        return {
+            keyId,
+            signature,
+            headers: headers.split(/\s+/).filter(h => h.length > 0),
+            algorithm,
+        };
+    }
+    /**
+     * Confirms base64(sha256(rawBody)) equals the value in the Digest header.
+     * Accepts both `SHA256=` and `SHA-256=` prefixes.
+     */
+    verifyDigest(rawBody, digestHeader) {
+        if (typeof digestHeader !== 'string') {
+            return false;
+        }
+        const m = /^\s*SHA-?256\s*=\s*(.+?)\s*$/i.exec(digestHeader);
+        if (!m) {
+            return false;
+        }
+        const expected = m[1];
+        const actual = crypto.createHash('sha256').update(rawBody).digest('base64');
+        const expectedBuf = Buffer.from(expected);
+        const actualBuf = Buffer.from(actual);
+        if (expectedBuf.length !== actualBuf.length) {
+            return false;
+        }
+        return crypto.timingSafeEqual(expectedBuf, actualBuf);
+    }
+    /**
+     * Rejects requests whose Date header is missing, unparseable, or outside the skew tolerance.
+     */
+    verifyDateFreshness(dateHeader) {
+        if (typeof dateHeader !== 'string') {
+            this.log.warn('Webhook signature: missing Date header');
+            return false;
+        }
+        const dateMs = Date.parse(dateHeader);
+        if (Number.isNaN(dateMs)) {
+            this.log.warn('Webhook signature: unparseable Date header');
+            return false;
+        }
+        const skew = Math.abs(Date.now() - dateMs);
+        if (skew > DATE_SKEW_TOLERANCE_MS) {
+            this.log.warn(`Webhook signature: Date header outside ${DATE_SKEW_TOLERANCE_MS / 60000}-minute window ` +
+                `(skew ${Math.round(skew / 1000)}s) - rejecting as stale/replayed. Check the host clock if this is unexpected.`);
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Builds the signing string from the signed header list, verbatim and in order.
+     * `(request-target)` => "<method> <path>"; every other token => "<name>: <value>".
+     * Returns null if any named header is absent or multi-valued.
+     */
+    buildSigningString(headerList, method, path, headers) {
+        const lines = [];
+        for (const name of headerList) {
+            if (name === '(request-target)') {
+                lines.push(`(request-target): ${(method || '').toLowerCase()} ${path}`);
+                continue;
+            }
+            const value = headers[name];
+            if (value === undefined || Array.isArray(value)) {
+                return null;
+            }
+            lines.push(`${name}: ${value}`);
+        }
+        return lines.join('\n');
+    }
+    /**
+     * Returns the PEM cert for a keyId, using a per-keyId cache and de-duplicating concurrent
+     * fetches. keyId rotation is handled implicitly: a new keyId is simply a new cache key.
+     */
+    async getCertificate(keyId) {
+        this.pruneExpired();
+        const cached = this.certCache.get(keyId);
+        if (cached && Date.now() < cached.expiresAt) {
+            return cached.pem;
+        }
+        const negativeUntil = this.negativeCache.get(keyId);
+        if (negativeUntil !== undefined && Date.now() < negativeUntil) {
+            return null;
+        }
+        const existing = this.inFlight.get(keyId);
+        if (existing) {
+            return existing;
+        }
+        const fetchPromise = this.fetchCertificate(keyId)
+            .then(pem => {
+            if (pem) {
+                this.evictIfFull();
+                this.certCache.set(keyId, { pem, expiresAt: this.computeExpiry(pem) });
+            }
+            else {
+                this.negativeCache.set(keyId, Date.now() + NEGATIVE_CACHE_TTL_MS);
+            }
+            return pem;
+        })
+            .finally(() => {
+            this.inFlight.delete(keyId);
+        });
+        this.inFlight.set(keyId, fetchPromise);
+        return fetchPromise;
+    }
+    async fetchCertificate(keyId) {
+        // Defend against keyId injecting an absolute URL / different host or scheme, or a flood of
+        // distinct malformed keyIds. Only a plain key-path shape is allowed.
+        if (!KEY_ID_PATTERN.test(keyId)) {
+            this.log.warn(`Webhook signature: refusing to fetch certificate for malformed keyId ${keyId}`);
+            return null;
+        }
+        try {
+            const resp = await axios_1.default.get(`${KEY_HOST}${keyId}`, {
+                timeout: KEY_FETCH_TIMEOUT_MS,
+                responseType: 'text',
+                maxRedirects: 0,
+                validateStatus: status => status === 200,
+            });
+            return typeof resp.data === 'string' ? resp.data : String(resp.data);
+        }
+        catch (error) {
+            this.log.warn(`Webhook signature: failed to fetch certificate ${keyId}:`, error instanceof Error ? error.message : error);
+            return null;
+        }
+    }
+    computeExpiry(pem) {
+        const cap = Date.now() + CERT_TTL_CAP_MS;
+        try {
+            const validTo = Date.parse(new crypto.X509Certificate(pem).validTo);
+            if (!Number.isNaN(validTo)) {
+                return Math.min(validTo, cap);
+            }
+        }
+        catch (_a) {
+            // Fall through to the hard cap if the cert can't be parsed for an expiry.
+        }
+        return cap;
+    }
+    rsaVerify(signingString, signatureB64, certPem) {
+        try {
+            return crypto
+                .createVerify('RSA-SHA256')
+                .update(signingString)
+                .verify(certPem, signatureB64, 'base64');
+        }
+        catch (error) {
+            this.log.debug('Webhook signature: crypto verify threw:', error);
+            return false;
+        }
+    }
+    pruneExpired() {
+        const now = Date.now();
+        for (const [keyId, entry] of this.certCache) {
+            if (now >= entry.expiresAt) {
+                this.certCache.delete(keyId);
+            }
+        }
+        for (const [keyId, until] of this.negativeCache) {
+            if (now >= until) {
+                this.negativeCache.delete(keyId);
+            }
+        }
+    }
+    // Bound cache growth: if at capacity, drop the oldest entry (Map preserves insertion order).
+    evictIfFull() {
+        while (this.certCache.size >= MAX_CERT_CACHE_ENTRIES) {
+            const oldest = this.certCache.keys().next().value;
+            if (oldest === undefined) {
+                break;
+            }
+            this.certCache.delete(oldest);
+        }
+    }
+}
+exports.SignatureVerifier = SignatureVerifier;
+//# sourceMappingURL=signatureVerifier.js.map

package/dist/webhook/signatureVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signatureVerifier.js","sourceRoot":"","sources":["../../src/webhook/signatureVerifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,+CAAiC;AACjC,kDAA0B;AAE1B;;;;;;;;GAQG;AAEH,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAC/C,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,uFAAuF;AACvF,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,kGAAkG;AAClG,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9C,yFAAyF;AACzF,kEAAkE;AAClE,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,2FAA2F;AAC3F,wEAAwE;AACxE,MAAM,uBAAuB,GAAG,CAAC,kBAAkB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AACvE,iGAAiG;AACjG,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAc/C,MAAa,iBAAiB;IAK5B,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;QAJvB,cAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC1C,aAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;QACrD,kBAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEhB,CAAC;IAE5C;;;OAGG;IACI,KAAK,CAAC,MAAM,CACjB,OAAe,EACf,MAA0B,EAC1B,IAAY,EACZ,OAAiC;QAEjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;gBACxF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,0FAA0F;YAC1F,2FAA2F;YAC3F,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;gBACvG,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;gBACzD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC/C,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACrF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;gBAChG,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6DAA6D,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC3F,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC9D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;gBACtE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,KAAK,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,oBAAoB,CAAC,UAAyC;QACpE,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,wBAAwB,CAAC;QACpC,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,KAAK;YACL,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YACvD,SAAS;SACV,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,OAAe,EAAE,YAA2C;QAC/E,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,UAAyC;QACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QAC3C,IAAI,IAAI,GAAG,sBAAsB,EAAE,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,IAAI,CACX,0CAA0C,sBAAsB,GAAG,KAAK,iBAAiB;gBACzF,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,+EAA+E,CAChH,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CACxB,UAAoB,EACpB,MAA0B,EAC1B,IAAY,EACZ,OAAiC;QAEjC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAChC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;gBACxE,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc,CAAC,KAAa;QACxC,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,GAAG,CAAC;QACpB,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;aAC9C,IAAI,CAAC,GAAG,CAAC,EAAE;YACV,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACvC,OAAO,YAAY,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAC1C,2FAA2F;QAC3F,qEAAqE;QACrE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wEAAwE,KAAK,EAAE,CAAC,CAAC;YAC/F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,eAAK,CAAC,GAAG,CAAC,GAAG,QAAQ,GAAG,KAAK,EAAE,EAAE;gBAClD,OAAO,EAAE,oBAAoB;gBAC7B,YAAY,EAAE,MAAM;gBACpB,YAAY,EAAE,CAAC;gBACf,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,GAAG;aACzC,CAAC,CAAC;YACH,OAAO,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kDAAkD,KAAK,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1H,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAAC,WAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,SAAS,CAAC,aAAqB,EAAE,YAAoB,EAAE,OAAe;QAC5E,IAAI,CAAC;YACH,OAAO,MAAM;iBACV,YAAY,CAAC,YAAY,CAAC;iBAC1B,MAAM,CAAC,aAAa,CAAC;iBACrB,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;YACjE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAChD,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;gBACjB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,6FAA6F;IACrF,WAAW;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,sBAAsB,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAClD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM;YACR,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;CACF;AA5RD,8CA4RC"}

package/dist/webhook/webhookServer.d.ts

@@ -9,11 +9,15 @@ export declare class WebhookServer {
     private eventHandlers;
     private authHandler;
     private isRunning;
+    private verifyEnabled;
+    private signatureVerifier;
     constructor(platform: IKHomeBridgeHomebridgePlatform, log: Logger);
     private startServer;
     setAuthHandler(auth: SmartThingsAuth): void;
     private handleOAuthCallback;
     private handleIncomingPost;
+    private handleLegacyPost;
+    private handleVerifiedPost;
     private handleSmartThingsLifecycle;
     private handlePing;
     private handleConfirmation;

package/dist/webhook/webhookServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhookServer.d.ts","sourceRoot":"","sources":["../../src/webhook/webhookServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGpC,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGnD,qBAAa,aAAa;IAOtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPtB,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,aAAa,CAAuC;IAC5D,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,SAAS,CAAS;gBAGP,QAAQ,EAAE,8BAA8B,EACxC,GAAG,EAAE,MAAM;IAa9B,OAAO,CAAC,WAAW;IAgCZ,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;YAIpC,mBAAmB;YAanB,kBAAkB;IAmDhC,OAAO,CAAC,0BAA0B;IAgClC,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,kBAAkB;IAsB1B,OAAO,CAAC,oBAAoB;IAqC5B,OAAO,CAAC,aAAa;IAcrB,OAAO,CAAC,qBAAqB;IAwBtB,eAAe,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,IAAI;IAIlE,OAAO,CAAC,mBAAmB;IAUpB,IAAI,IAAI,IAAI;IAOZ,eAAe,IAAI,OAAO;CAGlC"}
+{"version":3,"file":"webhookServer.d.ts","sourceRoot":"","sources":["../../src/webhook/webhookServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGpC,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AASnD,qBAAa,aAAa;IAStB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IATtB,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,aAAa,CAAuC;IAC5D,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,iBAAiB,CAAkC;gBAGxC,QAAQ,EAAE,8BAA8B,EACxC,GAAG,EAAE,MAAM;IAyB9B,OAAO,CAAC,WAAW;IAgCZ,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;YAIpC,mBAAmB;YAanB,kBAAkB;IAkDhC,OAAO,CAAC,gBAAgB;YAwCV,kBAAkB;IAgChC,OAAO,CAAC,0BAA0B;IAgClC,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,kBAAkB;IA4B1B,OAAO,CAAC,oBAAoB;IAqC5B,OAAO,CAAC,aAAa;IAcrB,OAAO,CAAC,qBAAqB;IAwBtB,eAAe,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,IAAI;IAIlE,OAAO,CAAC,mBAAmB;IAUpB,IAAI,IAAI,IAAI;IAOZ,eAAe,IAAI,OAAO;CAGlC"}

package/dist/webhook/webhookServer.js

@@ -39,7 +39,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.WebhookServer = void 0;
 const http = __importStar(require("http"));
 const url = __importStar(require("url"));
+const signatureVerifier_1 = require("./signatureVerifier");
 const axios_1 = __importDefault(require("axios"));
+// Lifecycles we process when signature verification is enabled. Anything else is dropped (400).
+const KNOWN_LIFECYCLES = ['PING', 'CONFIRMATION', 'INSTALL', 'UPDATE', 'UNINSTALL', 'CONFIGURATION', 'EVENT'];
+// Cap the inbound body on the public webhook endpoint. SmartThings lifecycle payloads are well under 1 KB.
+const MAX_BODY_BYTES = 1024 * 1024;
 class WebhookServer {
     constructor(platform, log) {
         this.platform = platform;
@@ -48,6 +53,21 @@ class WebhookServer {
         this.eventHandlers = [];
         this.authHandler = null;
         this.isRunning = false;
+        this.verifyEnabled = false;
+        this.signatureVerifier = null;
+        // Opt-in HTTP signature verification of inbound SmartThings webhooks.
+        if (this.platform.config.verifyWebhookSignatures === true) {
+            const serverUrl = (this.platform.config.server_url || '').trim();
+            if (serverUrl.toLowerCase().startsWith('https://')) {
+                this.verifyEnabled = true;
+                this.signatureVerifier = new signatureVerifier_1.SignatureVerifier(this.log);
+                this.log.info('Webhook signature verification is ENABLED - unsigned/invalid requests will be rejected with 401');
+            }
+            else {
+                this.log.error('verifyWebhookSignatures is enabled but Server URL is not https. ' +
+                    'Signature verification is DISABLED for this run. Set an https Server URL to enable it.');
+            }
+        }
         // Only start the webhook server if server_url is configured
         // This is needed for both OAuth callback (traditional flow) and device events
         if (this.platform.config.server_url && this.platform.config.server_url.trim() !== '') {
@@ -107,46 +127,43 @@ class WebhookServer {
     }
     async handleIncomingPost(req, res) {
         try {
-            let body = '';
+            // Accumulate as Buffer so signature verification can hash the exact received bytes.
+            const chunks = [];
+            let totalBytes = 0;
+            let aborted = false;
             req.on('data', chunk => {
-                body += chunk.toString();
+                if (aborted) {
+                    return;
+                }
+                const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                totalBytes += buf.length;
+                if (totalBytes > MAX_BODY_BYTES) {
+                    // Guard a public endpoint against memory exhaustion. SmartThings payloads are tiny.
+                    aborted = true;
+                    this.log.warn('Rejected webhook POST on / - request body exceeds size limit (413)');
+                    res.writeHead(413);
+                    res.end();
+                    req.destroy();
+                    return;
+                }
+                chunks.push(buf);
             });
             req.on('end', () => {
-                // Empty POSTs (tunnel/SmartThings health checks) must be acked, not 400'd —
-                // a 400 can be treated by SmartThings as a failed lifecycle delivery.
-                if (body.trim() === '') {
-                    this.log.debug('Received empty POST body on /, acknowledging');
-                    res.writeHead(200);
-                    res.end();
+                if (aborted) {
                     return;
                 }
-                try {
-                    const parsed = JSON.parse(body);
-                    // Detect SmartThings lifecycle format
-                    // SmartApps use "lifecycle", API_ONLY/Connected Service apps use "messageType"
-                    const lifecycleType = parsed.lifecycle || parsed.messageType;
-                    if (lifecycleType) {
-                        parsed.lifecycle = lifecycleType; // Normalize to "lifecycle" for handler
-                        this.handleSmartThingsLifecycle(parsed, res);
-                    }
-                    else if (parsed.deviceId && parsed.capability) {
-                        // Legacy direct ShortEvent format (for compatibility)
-                        this.notifyEventHandlers(parsed);
-                        res.writeHead(200);
-                        res.end();
-                    }
-                    else {
-                        this.log.debug('Received unknown POST format on /, ignoring');
-                        res.writeHead(200);
-                        res.end();
-                    }
+                const rawBody = Buffer.concat(chunks);
+                if (this.verifyEnabled) {
+                    this.handleVerifiedPost(rawBody, req, res).catch(error => {
+                        this.log.error('Error handling verified webhook POST:', error);
+                        if (!res.writableEnded) {
+                            res.writeHead(500);
+                            res.end();
+                        }
+                    });
                 }
-                catch (error) {
-                    // Malformed body — ack with 200 so SmartThings doesn't mark a lifecycle
-                    // delivery as failed; log for visibility.
-                    this.log.warn('Received unparseable POST body on /, acknowledging:', error);
-                    res.writeHead(200);
-                    res.end();
+                else {
+                    this.handleLegacyPost(rawBody.toString(), res);
                 }
             });
         }
@@ -156,6 +173,79 @@ class WebhookServer {
             res.end();
         }
     }
+    // Unauthenticated path (default). Behavior is unchanged from prior releases: every
+    // non-error case acks with 200 so SmartThings never marks a delivery as failed.
+    handleLegacyPost(body, res) {
+        // Empty POSTs (tunnel/SmartThings health checks) must be acked, not 400'd —
+        // a 400 can be treated by SmartThings as a failed lifecycle delivery.
+        if (body.trim() === '') {
+            this.log.debug('Received empty POST body on /, acknowledging');
+            res.writeHead(200);
+            res.end();
+            return;
+        }
+        try {
+            const parsed = JSON.parse(body);
+            // Detect SmartThings lifecycle format
+            // SmartApps use "lifecycle", API_ONLY/Connected Service apps use "messageType"
+            const lifecycleType = parsed.lifecycle || parsed.messageType;
+            if (lifecycleType) {
+                parsed.lifecycle = lifecycleType; // Normalize to "lifecycle" for handler
+                this.handleSmartThingsLifecycle(parsed, res);
+            }
+            else if (parsed.deviceId && parsed.capability) {
+                // Legacy direct ShortEvent format (for compatibility)
+                this.notifyEventHandlers(parsed);
+                res.writeHead(200);
+                res.end();
+            }
+            else {
+                this.log.debug('Received unknown POST format on /, ignoring');
+                res.writeHead(200);
+                res.end();
+            }
+        }
+        catch (error) {
+            // Malformed body — ack with 200 so SmartThings doesn't mark a lifecycle
+            // delivery as failed; log for visibility.
+            this.log.warn('Received unparseable POST body on /, acknowledging:', error);
+            res.writeHead(200);
+            res.end();
+        }
+    }
+    // Verified path (verifyWebhookSignatures enabled). Rejects anything without a valid
+    // SmartThings HTTP signature with 401, and only dispatches known lifecycles.
+    async handleVerifiedPost(rawBody, req, res) {
+        const path = url.parse(req.url || '/').pathname || '/';
+        const ok = await this.signatureVerifier.verify(rawBody, req.method, path, req.headers);
+        if (!ok) {
+            this.log.warn('Rejected webhook POST on / - HTTP signature verification failed (401)');
+            res.writeHead(401, { 'Content-Type': 'text/plain' });
+            res.end('Unauthorized');
+            return;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(rawBody.toString());
+        }
+        catch (error) {
+            // The request was signed by SmartThings, so an unparseable body is anomalous - drop it.
+            this.log.warn('Dropping signed webhook POST with unparseable body (400):', error);
+            res.writeHead(400);
+            res.end();
+            return;
+        }
+        const lifecycleType = parsed.lifecycle || parsed.messageType;
+        if (lifecycleType && KNOWN_LIFECYCLES.includes(lifecycleType)) {
+            parsed.lifecycle = lifecycleType; // Normalize to "lifecycle" for handler
+            this.handleSmartThingsLifecycle(parsed, res);
+        }
+        else {
+            this.log.warn(`Dropping webhook POST with non-allowlisted lifecycle (lifecycle=${lifecycleType !== null && lifecycleType !== void 0 ? lifecycleType : 'none'}) (400)`);
+            res.writeHead(400);
+            res.end();
+        }
+    }
     handleSmartThingsLifecycle(body, res) {
         const lifecycle = body.lifecycle;
         this.log.debug(`Received SmartThings lifecycle event: ${lifecycle}`);
@@ -206,13 +296,20 @@ class WebhookServer {
         const confirmationUrl = (_a = body.confirmationData) === null || _a === void 0 ? void 0 : _a.confirmationUrl;
         if (confirmationUrl) {
             this.log.info('Received SmartThings CONFIRMATION - hitting confirmation URL');
-            axios_1.default.get(confirmationUrl)
-                .then(() => {
-                this.log.info('Successfully confirmed SmartThings app registration');
-            })
-                .catch((error) => {
-                this.log.error('Failed to confirm SmartThings app registration:', error);
-            });
+            // Only call https URLs, never follow redirects, and time out — limits SSRF if a forged
+            // CONFIRMATION reaches this handler (always possible when verification is disabled).
+            if (typeof confirmationUrl === 'string' && /^https:\/\//i.test(confirmationUrl)) {
+                axios_1.default.get(confirmationUrl, { timeout: 5000, maxRedirects: 0 })
+                    .then(() => {
+                    this.log.info('Successfully confirmed SmartThings app registration');
+                })
+                    .catch((error) => {
+                    this.log.error('Failed to confirm SmartThings app registration:', error);
+                });
+            }
+            else {
+                this.log.error('Refusing to call non-https confirmation URL from CONFIRMATION lifecycle');
+            }
             const serverUrl = this.platform.config.server_url || '';
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ targetUrl: serverUrl }));

package/dist/webhook/webhookServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhookServer.js","sourceRoot":"","sources":["../../src/webhook/webhookServer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,2CAA6B;AAC7B,yCAA2B;AAI3B,kDAA0B;AAE1B,MAAa,aAAa;IAMxB,YACmB,QAAwC,EACxC,GAAW;QADX,aAAQ,GAAR,QAAQ,CAAgC;QACxC,QAAG,GAAH,GAAG,CAAQ;QAPtB,WAAM,GAAuB,IAAI,CAAC;QAClC,kBAAa,GAAoC,EAAE,CAAC;QACpD,gBAAW,GAA2B,IAAI,CAAC;QAC3C,cAAS,GAAG,KAAK,CAAC;QAMxB,4DAA4D;QAC5D,8EAA8E;QAC9E,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrF,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yDAAyD;gBACtE,+DAA+D;gBAC/D,6BAA6B,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;QAEvD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAI,EAAE,IAAI,CAAC,CAAC;YAE5C,IAAI,SAAS,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;gBAC7C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACjD,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;oBACzE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;iBAAM,IAAI,SAAS,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACtC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;YAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,cAAc,CAAC,IAAqB;QACzC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAU,EAAE,GAAwB;QACpE,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,GAAyB,EAAE,GAAwB;QAClF,IAAI,CAAC;YACH,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;gBACrB,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,4EAA4E;gBAC5E,sEAAsE;gBACtE,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACvB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;oBAC/D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAEhC,sCAAsC;oBACtC,+EAA+E;oBAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC;oBAC7D,IAAI,aAAa,EAAE,CAAC;wBAClB,MAAM,CAAC,SAAS,GAAG,aAAa,CAAC,CAAC,uCAAuC;wBACzE,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;oBAC/C,CAAC;yBAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;wBAChD,sDAAsD;wBACtD,IAAI,CAAC,mBAAmB,CAAC,MAAoB,CAAC,CAAC;wBAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;oBACZ,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;wBAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;oBACZ,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,wEAAwE;oBACxE,0CAA0C;oBAC1C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAC;oBAC5E,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YACvD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,0BAA0B,CAAC,IAAS,EAAE,GAAwB;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;QAErE,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,MAAM;gBACT,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC3B,MAAM;YACR,KAAK,cAAc;gBACjB,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACnC,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrC,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC9B,MAAM;YACR,KAAK,eAAe,CAAC;YACrB,KAAK,QAAQ,CAAC;YACd,KAAK,WAAW;gBACd,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,SAAS,kCAAkC,CAAC,CAAC;gBACxE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5B,MAAM;YACR;gBACE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,qCAAqC,SAAS,kBAAkB,CAAC,CAAC;gBACjF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5B,MAAM;QACV,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,IAAS,EAAE,GAAwB;;QACpD,MAAM,SAAS,GAAG,MAAA,IAAI,CAAC,QAAQ,0CAAE,SAAS,CAAC;QAC3C,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAClE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,iGAAiG;YACjG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;YAChF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,IAAS,EAAE,GAAwB;;QAC5D,MAAM,eAAe,GAAG,MAAA,IAAI,CAAC,gBAAgB,0CAAE,eAAe,CAAC;QAC/D,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAC9E,eAAK,CAAC,GAAG,CAAC,eAAe,CAAC;iBACvB,IAAI,CAAC,GAAG,EAAE;gBACT,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YACvE,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iDAAiD,EAAE,KAAK,CAAC,CAAC;YAC3E,CAAC,CAAC,CAAC;YACL,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;YACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,oGAAoG;YACpG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;YACzF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,IAAS,EAAE,GAAwB;QAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAEjC,yEAAyE;QACzE,IAAI,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,YAAY,EAAE,CAAC;YAC5B,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC,YAAY,CAAC;YAC9D,IAAI,cAAc,IAAI,UAAU,EAAE,CAAC;gBACjC,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,MAAM,CAAC;QACjC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,SAAS,KAAK,cAAc,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC1D,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;oBAC5B,MAAM,UAAU,GAAe;wBAC7B,QAAQ,EAAE,EAAE,CAAC,QAAQ;wBACrB,WAAW,EAAE,EAAE,CAAC,WAAW;wBAC3B,UAAU,EAAE,EAAE,CAAC,UAAU;wBACzB,SAAS,EAAE,EAAE,CAAC,SAAS;wBACvB,KAAK,EAAE,EAAE,CAAC,KAAK;qBAChB,CAAC;oBACF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACnH,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;oBACrC,UAAU,EAAE,CAAC;gBACf,CAAC;YACH,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,UAAU,iDAAiD,CAAC,CAAC;QAC3F,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAEO,aAAa,CAAC,IAAS,EAAE,GAAwB;;QACvD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAE9D,4CAA4C;QAC5C,MAAM,cAAc,GAAG,MAAA,MAAA,IAAI,CAAC,WAAW,0CAAE,YAAY,0CAAE,cAAc,CAAC;QACtE,MAAM,UAAU,GAAG,MAAA,MAAA,IAAI,CAAC,WAAW,0CAAE,YAAY,0CAAE,UAAU,CAAC;QAC9D,IAAI,cAAc,IAAI,UAAU,EAAE,CAAC;YACjC,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QACzD,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,CAAC;IAEO,qBAAqB,CAAC,cAAuB,EAAE,UAAmB;;QACxE,MAAM,YAAY,GAAG,MAAA,IAAI,CAAC,QAAQ,CAAC,IAAI,0CAAE,YAAY,CAAC;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACtD,MAAM,iBAAiB,GAAG,YAAY,CAAC,aAAa,EAAE,CAAC;QAEvD,MAAM,OAAO,GAAQ,EAAE,CAAC;QACxB,IAAI,cAAc,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;YACtD,OAAO,CAAC,gBAAgB,GAAG,cAAc,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iDAAiD,cAAc,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,UAAU,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;YACnD,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6CAA6C,UAAU,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAEM,eAAe,CAAC,OAAoC;QACzD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAEO,mBAAmB,CAAC,KAAiB;QAC3C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YACnC,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,IAAI;QACT,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IAEM,eAAe;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF;AAhSD,sCAgSC"}
+{"version":3,"file":"webhookServer.js","sourceRoot":"","sources":["../../src/webhook/webhookServer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,2CAA6B;AAC7B,yCAA2B;AAI3B,2DAAwD;AACxD,kDAA0B;AAE1B,gGAAgG;AAChG,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;AAC9G,2GAA2G;AAC3G,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnC,MAAa,aAAa;IAQxB,YACmB,QAAwC,EACxC,GAAW;QADX,aAAQ,GAAR,QAAQ,CAAgC;QACxC,QAAG,GAAH,GAAG,CAAQ;QATtB,WAAM,GAAuB,IAAI,CAAC;QAClC,kBAAa,GAAoC,EAAE,CAAC;QACpD,gBAAW,GAA2B,IAAI,CAAC;QAC3C,cAAS,GAAG,KAAK,CAAC;QAClB,kBAAa,GAAG,KAAK,CAAC;QACtB,sBAAiB,GAA6B,IAAI,CAAC;QAMzD,sEAAsE;QACtE,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,uBAAuB,KAAK,IAAI,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACjE,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,IAAI,CAAC,iBAAiB,GAAG,IAAI,qCAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;YACnH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,kEAAkE;oBAC/E,wFAAwF,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QACD,4DAA4D;QAC5D,8EAA8E;QAC9E,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrF,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yDAAyD;gBACtE,+DAA+D;gBAC/D,6BAA6B,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;QAEvD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAI,EAAE,IAAI,CAAC,CAAC;YAE5C,IAAI,SAAS,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;gBAC7C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACjD,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;oBACzE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;iBAAM,IAAI,SAAS,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACtC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;YAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,cAAc,CAAC,IAAqB;QACzC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAU,EAAE,GAAwB;QACpE,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,GAAyB,EAAE,GAAwB;QAClF,IAAI,CAAC;YACH,oFAAoF;YACpF,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;gBACrB,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChE,UAAU,IAAI,GAAG,CAAC,MAAM,CAAC;gBACzB,IAAI,UAAU,GAAG,cAAc,EAAE,CAAC;oBAChC,oFAAoF;oBACpF,OAAO,GAAG,IAAI,CAAC;oBACf,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;oBACpF,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACtC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;oBACvB,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;wBACvD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;wBAC/D,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;4BACvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;4BACnB,GAAG,CAAC,GAAG,EAAE,CAAC;wBACZ,CAAC;oBACH,CAAC,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YACvD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,gFAAgF;IACxE,gBAAgB,CAAC,IAAY,EAAE,GAAwB;QAC7D,4EAA4E;QAC5E,sEAAsE;QACtE,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC/D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAEhC,sCAAsC;YACtC,+EAA+E;YAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC;YAC7D,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,CAAC,SAAS,GAAG,aAAa,CAAC,CAAC,uCAAuC;gBACzE,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBAChD,sDAAsD;gBACtD,IAAI,CAAC,mBAAmB,CAAC,MAAoB,CAAC,CAAC;gBAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,0CAA0C;YAC1C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAC;YAC5E,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,6EAA6E;IACrE,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAAE,GAAyB,EAAE,GAAwB;QACnG,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC;QACvD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACxF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;YACvF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wFAAwF;YACxF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,KAAK,CAAC,CAAC;YAClF,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC;QAC7D,IAAI,aAAa,IAAI,gBAAgB,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,SAAS,GAAG,aAAa,CAAC,CAAC,uCAAuC;YACzE,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mEAAmE,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,MAAM,SAAS,CAAC,CAAC;YACnH,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,0BAA0B,CAAC,IAAS,EAAE,GAAwB;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;QAErE,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,MAAM;gBACT,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC3B,MAAM;YACR,KAAK,cAAc;gBACjB,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACnC,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrC,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC9B,MAAM;YACR,KAAK,eAAe,CAAC;YACrB,KAAK,QAAQ,CAAC;YACd,KAAK,WAAW;gBACd,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,SAAS,kCAAkC,CAAC,CAAC;gBACxE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5B,MAAM;YACR;gBACE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,qCAAqC,SAAS,kBAAkB,CAAC,CAAC;gBACjF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5B,MAAM;QACV,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,IAAS,EAAE,GAAwB;;QACpD,MAAM,SAAS,GAAG,MAAA,IAAI,CAAC,QAAQ,0CAAE,SAAS,CAAC;QAC3C,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAClE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,iGAAiG;YACjG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;YAChF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,IAAS,EAAE,GAAwB;;QAC5D,MAAM,eAAe,GAAG,MAAA,IAAI,CAAC,gBAAgB,0CAAE,eAAe,CAAC;QAC/D,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAC9E,uFAAuF;YACvF,qFAAqF;YACrF,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;gBAChF,eAAK,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;qBAC3D,IAAI,CAAC,GAAG,EAAE;oBACT,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;gBACvE,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACf,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iDAAiD,EAAE,KAAK,CAAC,CAAC;gBAC3E,CAAC,CAAC,CAAC;YACP,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;YACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,oGAAoG;YACpG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;YACzF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,IAAS,EAAE,GAAwB;QAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAEjC,yEAAyE;QACzE,IAAI,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,YAAY,EAAE,CAAC;YAC5B,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC,YAAY,CAAC;YAC9D,IAAI,cAAc,IAAI,UAAU,EAAE,CAAC;gBACjC,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,MAAM,CAAC;QACjC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,SAAS,KAAK,cAAc,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC1D,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;oBAC5B,MAAM,UAAU,GAAe;wBAC7B,QAAQ,EAAE,EAAE,CAAC,QAAQ;wBACrB,WAAW,EAAE,EAAE,CAAC,WAAW;wBAC3B,UAAU,EAAE,EAAE,CAAC,UAAU;wBACzB,SAAS,EAAE,EAAE,CAAC,SAAS;wBACvB,KAAK,EAAE,EAAE,CAAC,KAAK;qBAChB,CAAC;oBACF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACnH,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;oBACrC,UAAU,EAAE,CAAC;gBACf,CAAC;YACH,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,UAAU,iDAAiD,CAAC,CAAC;QAC3F,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAEO,aAAa,CAAC,IAAS,EAAE,GAAwB;;QACvD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAE9D,4CAA4C;QAC5C,MAAM,cAAc,GAAG,MAAA,MAAA,IAAI,CAAC,WAAW,0CAAE,YAAY,0CAAE,cAAc,CAAC;QACtE,MAAM,UAAU,GAAG,MAAA,MAAA,IAAI,CAAC,WAAW,0CAAE,YAAY,0CAAE,UAAU,CAAC;QAC9D,IAAI,cAAc,IAAI,UAAU,EAAE,CAAC;YACjC,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QACzD,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,CAAC;IAEO,qBAAqB,CAAC,cAAuB,EAAE,UAAmB;;QACxE,MAAM,YAAY,GAAG,MAAA,IAAI,CAAC,QAAQ,CAAC,IAAI,0CAAE,YAAY,CAAC;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACtD,MAAM,iBAAiB,GAAG,YAAY,CAAC,aAAa,EAAE,CAAC;QAEvD,MAAM,OAAO,GAAQ,EAAE,CAAC;QACxB,IAAI,cAAc,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;YACtD,OAAO,CAAC,gBAAgB,GAAG,cAAc,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iDAAiD,cAAc,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,UAAU,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;YACnD,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6CAA6C,UAAU,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAEM,eAAe,CAAC,OAAoC;QACzD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAEO,mBAAmB,CAAC,KAAiB;QAC3C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YACnC,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,IAAI;QACT,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IAEM,eAAe;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF;AA3XD,sCA2XC"}

package/package.json

@@ -2,7 +2,7 @@
   "private": false,
   "displayName": "Homebridge Smartthings oAuth Plugin",
   "name": "homebridge-smartthings-oauth",
-  "version": "1.0.66",
+  "version": "1.0.67-beta.0",
   "description": "Connects SmartThings devices to Homebridge.  Automatically discovers devices.",
   "license": "Apache-2.0",
   "repository": {