thirdweb 5.100.2 → 5.101.1-nightly-5277eddb70b3cf7b3dccbb4570c677f49b8dc854-20250524000345

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thirdweb",
-  "version": "5.100.2",
+  "version": "5.101.1-nightly-5277eddb70b3cf7b3dccbb4570c677f49b8dc854-20250524000345",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/thirdweb-dev/js.git#main"
@@ -250,6 +250,7 @@
     "toml": "3.0.0",
     "uqr": "0.1.2",
     "viem": "2.28.1",
+    "zod": "3.25.24",
     "@thirdweb-dev/engine": "3.0.1",
     "@thirdweb-dev/insight": "1.0.0"
   },
@@ -381,7 +382,7 @@
     "bench:compare": "bun run ./benchmarks/run.ts",
     "bench": "vitest -c ./test/vitest.config.ts bench",
     "format": "biome format ./src --write",
-    "lint": "knip && biome check ./src && tsc --project ./tsconfig.build.json --module esnext --noEmit",
+    "lint": "knip && biome check ./src && tsc --project ./tsconfig.build.json --module nodenext --moduleResolution nodenext --noEmit",
     "fix": "biome check ./src --fix",
     "knip": "knip",
     "build:generate": "bun scripts/generate/generate.ts",
@@ -392,7 +393,7 @@
     "build": "pnpm clean && pnpm build:types && pnpm build:cjs && pnpm build:esm",
     "build:cjs": "tsc --noCheck --project ./tsconfig.build.json --module commonjs --outDir ./dist/cjs --verbatimModuleSyntax false && printf '{\"type\":\"commonjs\"}' > ./dist/cjs/package.json",
     "build:esm": "tsc --noCheck --project ./tsconfig.build.json --module es2020 --outDir ./dist/esm && printf '{\"type\": \"module\",\"sideEffects\":false}' > ./dist/esm/package.json",
-    "build:types": "tsc --project ./tsconfig.build.json --module esnext --declarationDir ./dist/types --emitDeclarationOnly --declaration --declarationMap",
+    "build:types": "tsc --project ./tsconfig.build.json --module nodenext --moduleResolution nodenext --declarationDir ./dist/types --emitDeclarationOnly --declaration --declarationMap",
     "clean": "rimraf dist",
     "size": "size-limit",
     "test:watch": "vitest -c ./test/vitest.config.ts dev",

package/src/bridge/Webhook.test.ts

@@ -0,0 +1,605 @@
+import crypto from "node:crypto";
+import { describe, expect, it } from "vitest";
+import { type WebhookPayload, parse } from "./Webhook.js";
+
+const secret = "test-secret";
+
+// Helper function to generate signature
+// Accepts any JSON-serialisable body (either the already-stringified payload or
+// the raw object) and returns just the computed signature string.
+const generateSignature = async (
+  timestamp: string,
+  body: unknown,
+): Promise<string> => {
+  const payloadString = typeof body === "string" ? body : JSON.stringify(body);
+
+  return crypto
+    .createHmac("sha256", secret)
+    .update(`${timestamp}.${payloadString}`)
+    .digest("hex");
+};
+
+describe("parseIncomingWebhook", () => {
+  const testTimestamp = Math.floor(Date.now() / 1000).toString();
+  const validPayload: WebhookPayload = {
+    version: 2,
+    data: {
+      paymentId: "pay123",
+      clientId: "client123",
+      action: "TRANSFER",
+      status: "COMPLETED",
+      originToken: {
+        chainId: 1,
+        address: "0x1234567890123456789012345678901234567890" as const,
+        name: "Token",
+        symbol: "TKN",
+        decimals: 18,
+        priceUsd: 1.0,
+        iconUri: "https://example.com/icon.png",
+      },
+      originAmount: "1.0",
+      destinationToken: {
+        chainId: 1,
+        address: "0x1234567890123456789012345678901234567890" as const,
+        name: "Token",
+        symbol: "TKN",
+        decimals: 18,
+        priceUsd: 1.0,
+        iconUri: "https://example.com/icon.png",
+      },
+      destinationAmount: "1.0",
+      sender: "0x1234567890123456789012345678901234567890",
+      receiver: "0x1234567890123456789012345678901234567890",
+      type: "transfer",
+      transactions: [
+        "0x1234567890123456789012345678901234567890",
+        "0x1234567890123456789012345678901234567890",
+      ],
+      developerFeeBps: 100,
+      developerFeeRecipient: "0x1234567890123456789012345678901234567890",
+      purchaseData: {},
+    },
+  };
+
+  it("should successfully verify a valid webhook", async () => {
+    const signature = await generateSignature(
+      testTimestamp,
+      JSON.stringify(validPayload),
+    );
+    const headers = {
+      "x-payload-signature": signature,
+      "x-timestamp": testTimestamp,
+    };
+
+    const result = await parse(JSON.stringify(validPayload), headers, secret);
+    expect(result).toEqual(validPayload);
+  });
+
+  it("should accept alternative header names", async () => {
+    const signature = await generateSignature(
+      testTimestamp,
+      JSON.stringify(validPayload),
+    );
+    const headers = {
+      "x-pay-signature": signature,
+      "x-pay-timestamp": testTimestamp,
+    };
+
+    const result = await parse(JSON.stringify(validPayload), headers, secret);
+    expect(result).toEqual(validPayload);
+  });
+
+  it("should throw error for missing headers", async () => {
+    const headers: Record<string, string> = {};
+    await expect(
+      parse(JSON.stringify(validPayload), headers, secret),
+    ).rejects.toThrow(
+      "Missing required webhook headers: signature or timestamp",
+    );
+  });
+
+  it("should throw error for invalid signature", async () => {
+    const headers = {
+      "x-payload-signature": "invalid-signature",
+      "x-timestamp": testTimestamp,
+    };
+
+    await expect(
+      parse(JSON.stringify(validPayload), headers, secret),
+    ).rejects.toThrow("Invalid webhook signature");
+  });
+
+  it("should throw error for expired timestamp", async () => {
+    const oldTimestamp = (Math.floor(Date.now() / 1000) - 400).toString(); // 400 seconds old
+    const signature = await generateSignature(
+      oldTimestamp,
+      JSON.stringify(validPayload),
+    );
+    const headers = {
+      "x-payload-signature": signature,
+      "x-timestamp": oldTimestamp,
+    };
+
+    await expect(
+      parse(JSON.stringify(validPayload), headers, secret, 300),
+    ).rejects.toThrow(/Webhook timestamp is too old/);
+  });
+
+  it("should throw error for invalid JSON payload", async () => {
+    const invalidPayload = "invalid-json";
+    const signature = await generateSignature(testTimestamp, invalidPayload);
+    const headers = {
+      "x-payload-signature": signature,
+      "x-timestamp": testTimestamp,
+    };
+
+    await expect(parse(invalidPayload, headers, secret)).rejects.toThrow(
+      "Invalid webhook payload: not valid JSON",
+    );
+  });
+
+  it("should throw error for version 1 payload", async () => {
+    const v1Payload = {
+      version: 1,
+      data: {
+        someField: "value",
+      },
+    };
+    const v1PayloadString = JSON.stringify(v1Payload);
+    const signature = await generateSignature(testTimestamp, v1PayloadString);
+    const headers = {
+      "x-payload-signature": signature,
+      "x-timestamp": testTimestamp,
+    };
+
+    await expect(parse(v1PayloadString, headers, secret)).rejects.toThrow(
+      "Invalid webhook payload: version 1 is no longer supported, please upgrade to webhook version 2.",
+    );
+  });
+
+  it("should accept payload within tolerance window", async () => {
+    const recentTimestamp = (Math.floor(Date.now() / 1000) - 200).toString(); // 200 seconds old
+    const signature = await generateSignature(
+      recentTimestamp,
+      JSON.stringify(validPayload),
+    );
+    const headers = {
+      "x-payload-signature": signature,
+      "x-timestamp": recentTimestamp,
+    };
+
+    const result = await parse(
+      JSON.stringify(validPayload),
+      headers,
+      secret,
+      300,
+    );
+    expect(result).toEqual(validPayload);
+  });
+
+  describe("payload validation", () => {
+    it("should throw error for non-object payload", async () => {
+      const invalidPayload = JSON.stringify("not-an-object");
+      const signature = await generateSignature(testTimestamp, invalidPayload);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(invalidPayload, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for missing version", async () => {
+      const invalidPayload = {
+        data: {
+          transactionId: "tx123",
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for missing data object", async () => {
+      const invalidPayload = {
+        version: 2,
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for missing required fields", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          transactionId: "tx123",
+          // Missing other required fields
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for invalid action type", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          action: "INVALID_ACTION", // Invalid action type
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for invalid status type", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          status: "INVALID_STATUS", // Invalid status type
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for invalid hex address", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          destinationToken: "invalid-address", // Invalid hex address
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for invalid transactions array", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          transactions: "not-an-array", // Invalid transactions type
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for invalid developerFeeBps type", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          developerFeeBps: "not-a-number", // Invalid value (cannot coerce to number)
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for invalid purchaseData type", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          purchaseData: null, // Invalid purchaseData type
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    // Additional tests for full branch coverage
+
+    it("should throw error for invalid paymentId type", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          paymentId: 123, // number instead of string
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for invalid paymentLinkId type", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          paymentLinkId: 123, // number instead of string
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for invalid clientId type", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          clientId: 123, // number instead of string
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for invalid originToken type", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          originToken: 123, // number instead of string
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for invalid originAmount type", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          originAmount: 123, // number instead of string
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for invalid destinationAmount type", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          destinationAmount: 123, // number instead of string
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for invalid sender address", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          sender: "invalid-address", // not 0x-prefixed
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for invalid receiver address", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          receiver: "invalid-address", // not 0x-prefixed
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for invalid type field", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          type: 123, // number instead of string
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for invalid developerFeeRecipient address", async () => {
+      const invalidPayload = {
+        version: 2,
+        data: {
+          ...validPayload.data,
+          developerFeeRecipient: "invalid-address", // not 0x-prefixed
+        },
+      };
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+
+    it("should throw error for version 1 payload missing data object", async () => {
+      const invalidPayload = {
+        version: 1,
+        // no data field
+      } as unknown as WebhookPayload;
+      const payloadString = JSON.stringify(invalidPayload);
+      const signature = await generateSignature(testTimestamp, payloadString);
+      const headers = {
+        "x-payload-signature": signature,
+        "x-timestamp": testTimestamp,
+      };
+
+      await expect(
+        parse(payloadString, headers, secret),
+      ).rejects.toHaveProperty("name", "$ZodError");
+    });
+  });
+
+  it("should throw error for unsupported webhook version", async () => {
+    const invalidPayload = {
+      version: 3,
+      data: {},
+    };
+    const payloadString = JSON.stringify(invalidPayload);
+    const signature = await generateSignature(testTimestamp, payloadString);
+    const headers = {
+      "x-payload-signature": signature,
+      "x-timestamp": testTimestamp,
+    };
+
+    await expect(parse(payloadString, headers, secret)).rejects.toHaveProperty(
+      "name",
+      "$ZodError",
+    );
+  });
+});