idosell 0.4.41 → 0.4.43

package/changelog.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.43] - 2025-06-07
+### Changed
+- Webhook now supports HMAC checking and groups of webhooks
+- Added raw data to webhook headers and handlers
+
+
 ## [0.4.41] - 2025-06-07
 ### Added
 - Added webook support

package/dist/app.d.ts

@@ -1,5 +1,5 @@
 import type {
-    GetProductsResponse,
+    SearchProductsResponse,
     GetRmaResponse,
     GetReturnsResponse,
     GetOrdersResponse,
@@ -117,6 +117,7 @@ export interface IdosellErrorFaultStructure {
 export interface NormalizedIaiRequest<T = unknown> {
     headers: IaiWebhookHeaders;
     body: T;
+    rawBody: string
 }
 
 export declare const WEBHOOK_OBJECT_TYPE: {
@@ -162,9 +163,9 @@ export declare const WEBHOOK_EVENT_TYPE: {
 export type WebhookObjectType = typeof WEBHOOK_OBJECT_TYPE[keyof typeof WEBHOOK_OBJECT_TYPE];
 export type WebhookEventType = typeof WEBHOOK_EVENT_TYPE[keyof typeof WEBHOOK_EVENT_TYPE];
 
-interface ObjectBodyMap {
+export interface ObjectBodyMap {
     "client": GetClientsResponse;
-    "product": GetProductsResponse;
+    "product": SearchProductsResponse;
     "order": GetOrdersResponse;
     "return": GetReturnsResponse;
     "rma": GetRmaResponse;
@@ -214,16 +215,27 @@ export interface IaiWebhookHeaders {
     panelId: number;
     signature: string;
     webhookTime: Date;
+    raw: Record<string, string>
 }
 
 export interface WebhookContext<E extends WebhookEventType> {
     headers: IaiWebhookHeaders;
     body: ObjectBodyMap[EventObjectMap[E]];
+    rawBody: string;
+}
+
+export interface WebhookObjectContext<O extends WebhookObjectType> {
+    headers: IaiWebhookHeaders;
+    body: ObjectBodyMap[O];
+    rawBody: string;
 }
 
 export type WebhookHandler<E extends WebhookEventType> =
     (ctx: WebhookContext<E>) => Promise<void> | void;
 
+export type WebhookObjectHandler<O extends WebhookObjectType> =
+    (ctx: WebhookObjectContext<O>) => Promise<void> | void;
+
 export type HeaderValidator =
     (headers: IaiWebhookHeaders) => Promise<boolean> | boolean;
 
@@ -234,13 +246,17 @@ export type DispatchResult =
 
 export declare class WebhookChain {
     validateHeaders(validator: HeaderValidator): this;
+    validateSignature(hmacKey: string): this;
     on<E extends WebhookEventType>(eventType: E, handler: WebhookHandler<E>): this;
+    on<O extends WebhookObjectType>(objectType: O, handler: WebhookObjectHandler<O>): this;
     handle(req: import("node:http").IncomingMessage | Request): Promise<DispatchResult>;
 }
 
 export type Webhooks = {
     validateHeaders(validator: HeaderValidator): WebhookChain;
+    validateSignature(hmacKey: string): WebhookChain;
     on<E extends WebhookEventType>(eventType: E, handler: WebhookHandler<E>): WebhookChain;
+    on<O extends WebhookObjectType>(objectType: O, handler: WebhookObjectHandler<O>): WebhookChain;
 };
 
 export {};

package/dist/webhooks.js

@@ -1,5 +1,6 @@
 /* eslint-disable no-unused-vars */
 import { normalizeIaiRequest, WebhookValidationError } from "./webhooks.normalizer.js";
+import { createHmac } from "node:crypto";
 // ─── Runtime constants ────────────────────────────────────────────────────────
 export const WEBHOOK_OBJECT_TYPE = {
     CLIENT: "client",
@@ -74,19 +75,37 @@ const EVENT_OBJECT_MAP = {
 export class WebhookChain {
     slots = [];
     validator = null;
+    hmacKey;
     validateHeaders(validator) {
         this.validator = validator;
         return this;
     }
-    on(eventType, handler) {
-        this.slots.push({
-            eventType,
-            fn: handler,
-        });
+    /**
+     * Validate the request signature using HMAC SHA256.
+     * @param hmacKey Secret key used to compute the HMAC.
+     * @throws WebhookValidationError if the computed signature does not match the header.
+     */
+    validateSignature(hmacKey) {
+        this.hmacKey = hmacKey;
+        return this;
+    }
+    on(eventTypeOrObject, handler) {
+        const isObjectType = Object.values(WEBHOOK_OBJECT_TYPE).includes(eventTypeOrObject);
+        if (isObjectType) {
+            const matchedEvents = Object.entries(EVENT_OBJECT_MAP)
+                .filter(([, obj]) => obj === eventTypeOrObject)
+                .map(([evt]) => evt);
+            for (const evt of matchedEvents) {
+                this.slots.push({ eventType: evt, fn: handler });
+            }
+        }
+        else {
+            this.slots.push({ eventType: eventTypeOrObject, fn: handler });
+        }
         return this;
     }
     async handle(req) {
-        const { headers, body } = await normalizeIaiRequest(req);
+        const { headers, body, rawBody } = await normalizeIaiRequest(req);
         if (this.validator !== null) {
             let valid = false;
             try {
@@ -99,6 +118,13 @@ export class WebhookChain {
                 return { matched: false, eventType: null, reason: "validation_failed" };
             }
         }
+        // Validate signature if a key was provided
+        if (this.hmacKey) {
+            const computed = createHmac("sha256", this.hmacKey).update(rawBody).digest("hex");
+            if (computed !== headers.signature) {
+                throw new WebhookValidationError("Invalid webhook signature", "x-iai-signature");
+            }
+        }
         const incomingEvent = headers.eventType;
         const expectedObject = EVENT_OBJECT_MAP[incomingEvent];
         if (expectedObject !== undefined && headers.objectType !== expectedObject) {
@@ -108,7 +134,7 @@ export class WebhookChain {
         if (!slot) {
             return { matched: false, eventType: incomingEvent };
         }
-        await slot.fn({ headers, body });
+        await slot.fn({ headers, body, rawBody });
         return { matched: true, eventType: slot.eventType };
     }
 }
@@ -117,8 +143,11 @@ export const webhooks = {
     validateHeaders(validator) {
         return new WebhookChain().validateHeaders(validator);
     },
-    on(eventType, handler) {
-        return new WebhookChain().on(eventType, handler);
+    validateSignature(hmacKey) {
+        return new WebhookChain().validateSignature(hmacKey);
     },
+    on: ((eventTypeOrObject, handler) => {
+        return new WebhookChain().on(eventTypeOrObject, handler);
+    }),
 };
 export default webhooks;

package/dist/webhooks.normalizer.js

@@ -50,6 +50,7 @@ function extractHeaders(raw) {
         panelId: parseIntHeader(raw, "x-iai-panel-id"),
         signature: requireHeader(raw, "x-iai-signature"),
         webhookTime: parseDateHeader(raw, "x-iai-webhook-time"),
+        raw
     };
 }
 // ─── Type guard ──────────────────────────────────────────────────────────────
@@ -136,5 +137,5 @@ export async function normalizeIaiRequest(req) {
         throw new WebhookValidationError("Request body must be a JSON object", "body");
     }
     const headers = extractHeaders(flatHeaders);
-    return { headers, body };
+    return { headers, body, rawBody };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "idosell",
-  "version": "0.4.41",
+  "version": "0.4.43",
   "description": "Idosell 3 REST connector",
   "main": "dist/index.js",
   "types": "dist/gateways.d.ts",