hono-webhooks 0.5.0 → 0.6.0

package/dist/signatures.js

@@ -1,5 +1,6 @@
 // src/signatures.ts
 var encoder = new TextEncoder;
+var reject = (input, reason) => input.fail?.(reason) ?? false;
 function hmacKey(secret, hash) {
   if (!secret.length) {
     throw new Error("hono-webhooks: the signing secret is empty");
@@ -29,19 +30,23 @@ function fromBase64(base64) {
   }
 }
 var resolveSecret = async (secret, c) => typeof secret === "function" ? secret(c) : secret;
+var signedUrls = async (url, c) => [await url?.(c) ?? c.req.url].flat();
+var outsideTolerance = (seconds, toleranceSeconds) => Math.abs(Date.now() / 1000 - seconds) > toleranceSeconds;
 function hmac(options) {
   const { header, encoding, prefix = "", hash = "SHA-256" } = options;
   const name = header.toLowerCase();
   return {
-    verify: (secret) => async ({ c, rawBody, headers }) => {
-      const value = headers[name];
-      if (!value?.startsWith(prefix))
-        return false;
+    verify: (secret) => async (input) => {
+      const value = input.headers[name];
+      if (!value)
+        return reject(input, "missing-header");
+      if (!value.startsWith(prefix))
+        return reject(input, "malformed");
       const encoded = value.slice(prefix.length);
       const signature = encoding === "hex" ? fromHex(encoded) : fromBase64(encoded);
       if (!signature)
-        return false;
-      return hmacVerify(await resolveSecret(secret, c), rawBody, signature, hash);
+        return reject(input, "malformed");
+      return await hmacVerify(await resolveSecret(secret, input.c), input.rawBody, signature, hash) || reject(input, "mismatch");
     },
     async sign(rawBody, secret) {
       const signature = await hmacSign(secret, rawBody, hash);
@@ -56,27 +61,31 @@ var github = hmac({
   encoding: "hex",
   prefix: "sha256="
 });
+var meta = github;
 var shopify = hmac({
   header: "x-shopify-hmac-sha256",
   encoding: "base64"
 });
 var stripe = {
-  verify: (secret, { toleranceSeconds = 300 } = {}) => async ({ c, rawBody, headers }) => {
-    const parts = (headers["stripe-signature"] ?? "").split(",").map((part) => part.split("="));
+  verify: (secret, { toleranceSeconds = 300 } = {}) => async (input) => {
+    const header = input.headers["stripe-signature"];
+    if (!header)
+      return reject(input, "missing-header");
+    const parts = header.split(",").map((part) => part.split("="));
     const timestamp = parts.find(([k]) => k === "t")?.[1] ?? "";
     if (!/^\d+$/.test(timestamp))
-      return false;
-    if (Math.abs(Date.now() / 1000 - Number(timestamp)) > toleranceSeconds) {
-      return false;
+      return reject(input, "malformed");
+    if (outsideTolerance(Number(timestamp), toleranceSeconds)) {
+      return reject(input, "timestamp-out-of-tolerance");
     }
-    const key = await resolveSecret(secret, c);
+    const key = await resolveSecret(secret, input.c);
     for (const [k, v] of parts) {
       const signature = k === "v1" && v ? fromHex(v) : undefined;
-      if (signature && await hmacVerify(key, `${timestamp}.${rawBody}`, signature)) {
+      if (signature && await hmacVerify(key, `${timestamp}.${input.rawBody}`, signature)) {
         return true;
       }
     }
-    return false;
+    return reject(input, "mismatch");
   },
   async sign(rawBody, secret, { timestamp } = {}) {
     const t = timestamp ?? Math.floor(Date.now() / 1000);
@@ -92,25 +101,29 @@ function svixKey(secret) {
   return key;
 }
 var svix = {
-  verify: (secret, { toleranceSeconds = 300 } = {}) => async ({ c, rawBody, headers }) => {
+  verify: (secret, { toleranceSeconds = 300 } = {}) => async (input) => {
+    const { headers } = input;
     const prefix = headers["svix-id"] ? "svix" : "webhook";
     const id = headers[`${prefix}-id`];
-    const timestamp = headers[`${prefix}-timestamp`] ?? "";
+    const timestamp = headers[`${prefix}-timestamp`];
     const signatures = headers[`${prefix}-signature`];
-    if (!id || !signatures || !/^\d+$/.test(timestamp))
-      return false;
-    if (Math.abs(Date.now() / 1000 - Number(timestamp)) > toleranceSeconds) {
-      return false;
+    if (!id || !signatures || !timestamp) {
+      return reject(input, "missing-header");
     }
-    const key = svixKey(await resolveSecret(secret, c));
+    if (!/^\d+$/.test(timestamp))
+      return reject(input, "malformed");
+    if (outsideTolerance(Number(timestamp), toleranceSeconds)) {
+      return reject(input, "timestamp-out-of-tolerance");
+    }
+    const key = svixKey(await resolveSecret(secret, input.c));
     for (const entry of signatures.split(" ")) {
       const [version, encoded] = entry.split(",");
       const signature = version === "v1" && encoded ? fromBase64(encoded) : undefined;
-      if (signature && await hmacVerify(key, `${id}.${timestamp}.${rawBody}`, signature)) {
+      if (signature && await hmacVerify(key, `${id}.${timestamp}.${input.rawBody}`, signature)) {
         return true;
       }
     }
-    return false;
+    return reject(input, "mismatch");
   },
   async sign(rawBody, secret, { id, timestamp } = {}) {
     const msgId = id ?? `msg_${crypto.randomUUID().replaceAll("-", "")}`;
@@ -123,10 +136,144 @@ var svix = {
     };
   }
 };
+var compareKey;
+async function secretsEqual(given, expected) {
+  if (!expected)
+    throw new Error("hono-webhooks: the shared secret is empty");
+  compareKey ??= crypto.subtle.generateKey({ name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+  const key = await compareKey;
+  const mac = await crypto.subtle.sign("HMAC", key, encoder.encode(expected));
+  return crypto.subtle.verify("HMAC", key, mac, encoder.encode(given));
+}
+function sharedSecret(options) {
+  const { prefix = "" } = options;
+  const name = options.header.toLowerCase();
+  return {
+    verify: (secret) => async (input) => {
+      const value = input.headers[name];
+      if (!value)
+        return reject(input, "missing-header");
+      if (!value.startsWith(prefix))
+        return reject(input, "malformed");
+      return await secretsEqual(value.slice(prefix.length), await resolveSecret(secret, input.c)) || reject(input, "mismatch");
+    },
+    async sign(_rawBody, secret) {
+      return { [name]: `${prefix}${secret}` };
+    }
+  };
+}
+var infisical = {
+  verify: (secret, { toleranceSeconds = 300 } = {}) => async (input) => {
+    const header = input.headers["x-infisical-signature"];
+    if (!header)
+      return reject(input, "missing-header");
+    const signature = fromHex(header.split(";")[1] ?? "");
+    if (!signature?.length)
+      return reject(input, "malformed");
+    let timestamp;
+    try {
+      timestamp = JSON.parse(input.rawBody)?.timestamp;
+    } catch {}
+    if (typeof timestamp !== "number")
+      return reject(input, "malformed");
+    if (!await hmacVerify(await resolveSecret(secret, input.c), input.rawBody, signature)) {
+      return reject(input, "mismatch");
+    }
+    return !outsideTolerance(timestamp / 1000, toleranceSeconds) || reject(input, "timestamp-out-of-tolerance");
+  },
+  async sign(rawBody, secret) {
+    let t;
+    try {
+      t = JSON.parse(rawBody)?.timestamp;
+    } catch {}
+    const signature = toHex(await hmacSign(secret, rawBody));
+    return { "x-infisical-signature": `t=${t ?? Date.now()};${signature}` };
+  }
+};
+function twilioPayload(url, rawBody) {
+  const fields = [...new URLSearchParams(rawBody)].sort(([a, x], [b, y]) => a === b ? x < y ? -1 : 1 : a < b ? -1 : 1);
+  return url + fields.map(([k, v]) => k + v).join("");
+}
+var twilio = {
+  verify: (secret, { url } = {}) => async (input) => {
+    const signature = input.headers["x-twilio-signature"];
+    if (!signature)
+      return reject(input, "missing-header");
+    const bytes = fromBase64(signature);
+    if (!bytes)
+      return reject(input, "malformed");
+    const key = await resolveSecret(secret, input.c);
+    for (const candidate of await signedUrls(url, input.c)) {
+      const payload = twilioPayload(candidate, input.rawBody);
+      if (await hmacVerify(key, payload, bytes, "SHA-1"))
+        return true;
+    }
+    return reject(input, "mismatch");
+  },
+  async sign(rawBody, secret, options) {
+    if (!options?.url)
+      throw new Error("hono-webhooks: twilio.sign needs a url");
+    const signature = await hmacSign(secret, twilioPayload(options.url, rawBody), "SHA-1");
+    return { "x-twilio-signature": toBase64(signature) };
+  }
+};
+var HUBSPOT_DECODE = {
+  "%3A": ":",
+  "%2F": "/",
+  "%3F": "?",
+  "%40": "@",
+  "%21": "!",
+  "%24": "$",
+  "%27": "'",
+  "%28": "(",
+  "%29": ")",
+  "%2A": "*",
+  "%2C": ",",
+  "%3B": ";"
+};
+var hubspotUrl = (url) => url.replace(/%(3A|2F|3F|40|21|24|27|28|29|2A|2C|3B)/gi, (match) => HUBSPOT_DECODE[match.toUpperCase()] ?? match);
+var hubspot = {
+  verify: (secret, { url, toleranceSeconds = 300 } = {}) => async (input) => {
+    const signature = input.headers["x-hubspot-signature-v3"];
+    const timestamp = input.headers["x-hubspot-request-timestamp"];
+    if (!signature || !timestamp)
+      return reject(input, "missing-header");
+    const bytes = fromBase64(signature);
+    if (!bytes || !/^\d+$/.test(timestamp))
+      return reject(input, "malformed");
+    if (outsideTolerance(Number(timestamp) / 1000, toleranceSeconds)) {
+      return reject(input, "timestamp-out-of-tolerance");
+    }
+    const key = await resolveSecret(secret, input.c);
+    const method = input.c.req.method.toUpperCase();
+    for (const candidate of await signedUrls(url, input.c)) {
+      const payload = `${method}${hubspotUrl(candidate)}${input.rawBody}${timestamp}`;
+      if (await hmacVerify(key, payload, bytes))
+        return true;
+    }
+    return reject(input, "mismatch");
+  },
+  async sign(rawBody, secret, options) {
+    if (!options?.url)
+      throw new Error("hono-webhooks: hubspot.sign needs a url");
+    const t = options.timestamp ?? Date.now();
+    const method = (options.method ?? "POST").toUpperCase();
+    const signature = await hmacSign(secret, `${method}${hubspotUrl(options.url)}${rawBody}${t}`);
+    return {
+      "x-hubspot-signature-v3": toBase64(signature),
+      "x-hubspot-request-timestamp": String(t)
+    };
+  }
+};
 export {
   github,
   hmac,
+  hubspot,
+  infisical,
+  meta,
+  sharedSecret,
   shopify,
   stripe,
-  svix
+  svix,
+  twilio
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono-webhooks",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Type-safe webhook routes for Hono, validated with any Standard Schema library (Zod, Valibot, ArkType)",
   "type": "module",
   "main": "./dist/index.js",
@@ -88,7 +88,7 @@
     "@opentelemetry/sdk-trace-base": "^2.12.0",
     "@types/bun": "^1.4.2",
     "@typescript/native-preview": "^7.0.0-dev.20260707.2",
-    "hanzio": "^3.1.0",
+    "hanzio": "^3.4.0",
     "hono": "^4.13.10",
     "husky": "^9.1.7",
     "typescript": "^7.0.2",