payload-plugin-newsletter 0.21.1 → 0.21.3

package/CHANGELOG.md

@@ -1,3 +1,21 @@
+## [0.21.3] - 2025-08-06
+
+### Fixed
+- Fixed webhook authentication by using correct Broadcast header names
+  - Changed from `x-broadcast-signature` to `broadcast-webhook-signature`
+  - Changed from `x-broadcast-timestamp` to `broadcast-webhook-timestamp`
+  - Added support for optional `broadcast-webhook-id` header
+  - Added timestamp validation to prevent replay attacks (5 minute window)
+  - Headers now match Broadcast's actual webhook implementation
+
+## [0.21.2] - 2025-08-06
+
+### Fixed
+- Fixed webhook endpoint paths to include `/newsletter` prefix for proper API routing
+  - Changed `/webhooks/broadcast` to `/newsletter/webhooks/broadcast`
+  - Changed `/webhooks/verify` to `/newsletter/webhooks/verify`
+  - This ensures webhooks work correctly with Payload's API routing
+
 ## [0.21.1] - 2025-08-06
 
 ### Fixed

package/dist/server.js

@@ -2725,7 +2725,7 @@ async function routeWebhookEvent(event, req, config) {
 // src/endpoints/webhooks/broadcast.ts
 var createBroadcastWebhookEndpoint = (config) => {
   return {
-    path: "/webhooks/broadcast",
+    path: "/newsletter/webhooks/broadcast",
     method: "post",
     handler: async (req) => {
       try {
@@ -2738,12 +2738,19 @@ var createBroadcastWebhookEndpoint = (config) => {
           return Response.json({ error: "Webhook not configured" }, { status: 401 });
         }
         const headers = req.headers;
-        const signature = headers.get("x-broadcast-signature");
-        const timestamp = headers.get("x-broadcast-timestamp");
+        const signature = headers.get("broadcast-webhook-signature");
+        const timestamp = headers.get("broadcast-webhook-timestamp");
+        const webhookId = headers.get("broadcast-webhook-id");
         if (!signature || !timestamp) {
-          console.error("[Broadcast Webhook] Missing signature or timestamp");
+          console.error("[Broadcast Webhook] Missing signature or timestamp headers");
           return Response.json({ error: "Invalid request" }, { status: 401 });
         }
+        const timestampNum = parseInt(timestamp, 10);
+        const currentTime = Math.floor(Date.now() / 1e3);
+        if (Math.abs(currentTime - timestampNum) > 300) {
+          console.error("[Broadcast Webhook] Timestamp too old or invalid");
+          return Response.json({ error: "Invalid timestamp" }, { status: 401 });
+        }
         let rawBodyString;
         let rawBody;
         if (typeof req.json === "function") {
@@ -2791,7 +2798,7 @@ var createBroadcastWebhookEndpoint = (config) => {
 // src/endpoints/webhooks/verify.ts
 var createWebhookVerifyEndpoint = (config) => {
   return {
-    path: "/webhooks/verify",
+    path: "/newsletter/webhooks/verify",
     method: "post",
     handler: async (req) => {
       try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payload-plugin-newsletter",
-  "version": "0.21.1",
+  "version": "0.21.3",
   "description": "Complete newsletter management plugin for Payload CMS with subscriber management, magic link authentication, and email service integration",
   "type": "module",
   "main": "./dist/index.js",