pipework 0.8.7 → 0.8.8

package/dist/webhook/verify.js

@@ -0,0 +1,61 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+export function hmacVerifier(options) {
+    const algorithm = options.algorithm ?? 'sha256';
+    const encoding = options.encoding ?? 'hex';
+    const prefix = options.prefix ?? '';
+    return {
+        verify(rawBody, headers) {
+            const headerValue = headers[options.header.toLowerCase()];
+            if (headerValue === undefined || headerValue === '')
+                return false;
+            const payload = options.computePayload !== undefined
+                ? options.computePayload(rawBody, headers)
+                : rawBody;
+            const expected = prefix + createHmac(algorithm, options.secret).update(payload).digest(encoding);
+            try {
+                return timingSafeEqual(Buffer.from(headerValue), Buffer.from(expected));
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}
+export function stripeVerifier(secret) {
+    return {
+        verify(rawBody, headers) {
+            const sigHeader = headers['stripe-signature'];
+            if (sigHeader === undefined)
+                return false;
+            const parts = new Map();
+            for (const pair of sigHeader.split(',')) {
+                const eqIdx = pair.indexOf('=');
+                if (eqIdx === -1)
+                    continue;
+                parts.set(pair.slice(0, eqIdx).trim(), pair.slice(eqIdx + 1).trim());
+            }
+            const timestamp = parts.get('t');
+            const v1Sig = parts.get('v1');
+            if (timestamp === undefined || v1Sig === undefined)
+                return false;
+            const signedPayload = Buffer.from(`${timestamp}.${rawBody.toString('utf-8')}`);
+            const expected = createHmac('sha256', secret).update(signedPayload).digest('hex');
+            try {
+                return timingSafeEqual(Buffer.from(v1Sig), Buffer.from(expected));
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}
+export function githubVerifier(secret) {
+    return hmacVerifier({
+        secret,
+        algorithm: 'sha256',
+        header: 'x-hub-signature-256',
+        prefix: 'sha256=',
+        encoding: 'hex',
+    });
+}
+//# sourceMappingURL=verify.js.map

package/dist/webhook/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/webhook/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAMzD,MAAM,UAAU,YAAY,CAAC,OAO5B;IACC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAA;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAA;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;IAEnC,OAAO;QACL,MAAM,CAAC,OAAO,EAAE,OAAO;YACrB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;YACzD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE;gBAAE,OAAO,KAAK,CAAA;YAEjE,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,KAAK,SAAS;gBAClD,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;gBAC1C,CAAC,CAAC,OAAO,CAAA;YAEX,MAAM,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAEhG,IAAI,CAAC;gBACH,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;YACzE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,OAAO;QACL,MAAM,CAAC,OAAO,EAAE,OAAO;YACrB,MAAM,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;YAC7C,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAA;YAEzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;YACvC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAC/B,IAAI,KAAK,KAAK,CAAC,CAAC;oBAAE,SAAQ;gBAC1B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACtE,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC7B,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAA;YAEhE,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YAC9E,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAEjF,IAAI,CAAC;gBACH,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;YACnE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,OAAO,YAAY,CAAC;QAClB,MAAM;QACN,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAA;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pipework",
-  "version": "0.8.7",
+  "version": "0.8.8",
   "description": "TypeScript framework for multi-tenant SaaS applications. PostgreSQL-only.",
   "type": "module",
   "license": "MIT",