payload-plugin-newsletter 0.21.2 → 0.21.4

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+## [0.21.4] - 2025-08-07
+
+### Fixed
+- Fixed ESLint error by prefixing unused webhookId variable with underscore
+
+## [0.21.3] - 2025-08-06
+
+### Fixed
+- Fixed webhook authentication by using correct Broadcast header names
+  - Changed from `x-broadcast-signature` to `broadcast-webhook-signature`
+  - Changed from `x-broadcast-timestamp` to `broadcast-webhook-timestamp`
+  - Added support for optional `broadcast-webhook-id` header
+  - Added timestamp validation to prevent replay attacks (5 minute window)
+  - Headers now match Broadcast's actual webhook implementation
+
 ## [0.21.2] - 2025-08-06
 
 ### Fixed

package/dist/server.js

@@ -2738,12 +2738,19 @@ var createBroadcastWebhookEndpoint = (config) => {
           return Response.json({ error: "Webhook not configured" }, { status: 401 });
         }
         const headers = req.headers;
-        const signature = headers.get("x-broadcast-signature");
-        const timestamp = headers.get("x-broadcast-timestamp");
+        const signature = headers.get("broadcast-webhook-signature");
+        const timestamp = headers.get("broadcast-webhook-timestamp");
+        const _webhookId = headers.get("broadcast-webhook-id");
         if (!signature || !timestamp) {
-          console.error("[Broadcast Webhook] Missing signature or timestamp");
+          console.error("[Broadcast Webhook] Missing signature or timestamp headers");
           return Response.json({ error: "Invalid request" }, { status: 401 });
         }
+        const timestampNum = parseInt(timestamp, 10);
+        const currentTime = Math.floor(Date.now() / 1e3);
+        if (Math.abs(currentTime - timestampNum) > 300) {
+          console.error("[Broadcast Webhook] Timestamp too old or invalid");
+          return Response.json({ error: "Invalid timestamp" }, { status: 401 });
+        }
         let rawBodyString;
         let rawBody;
         if (typeof req.json === "function") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payload-plugin-newsletter",
-  "version": "0.21.2",
+  "version": "0.21.4",
   "description": "Complete newsletter management plugin for Payload CMS with subscriber management, magic link authentication, and email service integration",
   "type": "module",
   "main": "./dist/index.js",