tupay 0.16.0 → 0.17.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/resources/accounts.d.ts +2 -1
- package/dist/cjs/resources/accounts.d.ts.map +1 -1
- package/dist/cjs/resources/accounts.js.map +1 -1
- package/dist/cjs/webhooks.d.ts.map +1 -1
- package/dist/cjs/webhooks.js +14 -9
- package/dist/cjs/webhooks.js.map +1 -1
- package/dist/esm/resources/accounts.d.ts +2 -1
- package/dist/esm/resources/accounts.d.ts.map +1 -1
- package/dist/esm/resources/accounts.js.map +1 -1
- package/dist/esm/webhooks.d.ts.map +1 -1
- package/dist/esm/webhooks.js +14 -9
- package/dist/esm/webhooks.js.map +1 -1
- package/package.json +1 -1
|
@@ -19,7 +19,8 @@ export interface CreateAccountParams {
|
|
|
19
19
|
tgcRate?: TgcRate;
|
|
20
20
|
/**
|
|
21
21
|
* Coordonnées bancaires XPF du vendeur. Facultatives à la création —
|
|
22
|
-
* tant qu'elles manquent, `payoutsEnabled` est faux.
|
|
22
|
+
* tant qu'elles manquent, `payoutsEnabled` est faux. IBAN français ;
|
|
23
|
+
* la clé de contrôle est vérifiée, un caractère mal recopié est refusé.
|
|
23
24
|
*/
|
|
24
25
|
ibanXpf?: string;
|
|
25
26
|
/** Omise, le SDK génère un UUID v4 — la requête devient rejouable. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../../src/resources/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,UAAU,EACV,MAAM,EACN,OAAO,EACR,MAAM,aAAa,CAAA;AAEpB,MAAM,WAAW,mBAAmB;IAClC,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB
|
|
1
|
+
{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../../src/resources/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,UAAU,EACV,MAAM,EACN,OAAO,EACR,MAAM,aAAa,CAAA;AAEpB,MAAM,WAAW,mBAAmB;IAClC,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,QAAQ;IACP,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAE1C,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAWrD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ5C;;;;;;OAMG;IACH;;;;;;;;;;;OAWG;IACG,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAQ1D;;;;;;OAMG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,GAAE,UAAe,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAU7E,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;CAQ3C"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../../src/resources/accounts.ts"],"names":[],"mappings":";;;AAAA,4CAA0C;AAC1C,0CAKoB;
|
|
1
|
+
{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../../src/resources/accounts.ts"],"names":[],"mappings":";;;AAAA,4CAA0C;AAC1C,0CAKoB;AAmCpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAa,QAAQ;IACU;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,KAAK,CAAC,MAAM,CAAC,MAA2B;QACtC,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;QAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAoB;YAC5D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,WAAW;YACjB,IAAI;YACJ,cAAc,EAAE,cAAc,IAAI,uBAAW,CAAC,cAAc,EAAE;SAC/D,CAAC,CAAA;QACF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAoB;YAC5D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa,kBAAkB,CAAC,EAAE,CAAC,EAAE;SAC5C,CAAC,CAAA;QACF,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;OAMG;IACH;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,eAAe,CAAC,EAAU;QAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAA2B;YACnE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa,kBAAkB,CAAC,EAAE,CAAC,UAAU;SACpD,CAAC,CAAA;QACF,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,SAAqB,EAAE;QACnD,OAAO,IAAA,0BAAe,EACpB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAqB;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa,kBAAkB,CAAC,EAAE,CAAC,UAAU;YACnD,KAAK,EAAE,IAAA,0BAAe,EAAC,MAAM,CAAC;SAC/B,CAAC,CACH,CAAA;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,IAAA,0BAAe,EACpB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB;YAC7C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,WAAW;SAClB,CAAC,CACH,CAAA;IACH,CAAC;CACF;AA1ED,4BA0EC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;
|
|
1
|
+
{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAgCD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,qBAA0B,GAClC,YAAY,CAsDd"}
|
package/dist/cjs/webhooks.js
CHANGED
|
@@ -19,7 +19,7 @@ const errors_js_1 = require("./errors.js");
|
|
|
19
19
|
exports.DEFAULT_TOLERANCE_SECONDS = 300;
|
|
20
20
|
function parseHeader(header) {
|
|
21
21
|
let timestamp = null;
|
|
22
|
-
|
|
22
|
+
const v1 = [];
|
|
23
23
|
for (const part of header.split(',')) {
|
|
24
24
|
const separator = part.indexOf('=');
|
|
25
25
|
if (separator === -1)
|
|
@@ -32,10 +32,10 @@ function parseHeader(header) {
|
|
|
32
32
|
timestamp = parsed;
|
|
33
33
|
}
|
|
34
34
|
else if (key === 'v1') {
|
|
35
|
-
v1
|
|
35
|
+
v1.push(value);
|
|
36
36
|
}
|
|
37
37
|
}
|
|
38
|
-
return timestamp === null || v1 ===
|
|
38
|
+
return timestamp === null || v1.length === 0 ? null : { timestamp, v1 };
|
|
39
39
|
}
|
|
40
40
|
/**
|
|
41
41
|
* Vérifie la signature et renvoie l'événement typé.
|
|
@@ -63,12 +63,17 @@ function constructEvent(payload, header, secret, options = {}) {
|
|
|
63
63
|
throw new errors_js_1.TupaySignatureVerificationError(`Horodatage hors tolérance (${tolerance} s) — possible rejeu d’une livraison capturée.`);
|
|
64
64
|
}
|
|
65
65
|
const raw = typeof payload === 'string' ? payload : payload.toString('utf8');
|
|
66
|
-
const expected = (0, node_crypto_1.createHmac)('sha256', secret)
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
//
|
|
70
|
-
|
|
71
|
-
|
|
66
|
+
const expected = Buffer.from((0, node_crypto_1.createHmac)('sha256', secret).update(`${parts.timestamp}.${raw}`, 'utf8').digest('hex'), 'utf8');
|
|
67
|
+
// UNE signature qui correspond suffit (renouvellement du secret en
|
|
68
|
+
// cours). Toutes sont comparées, sans sortie anticipée. Longueurs
|
|
69
|
+
// comparées d'abord : timingSafeEqual lève si elles diffèrent.
|
|
70
|
+
let valide = false;
|
|
71
|
+
for (const candidat of parts.v1) {
|
|
72
|
+
const recu = Buffer.from(candidat, 'utf8');
|
|
73
|
+
if (recu.length === expected.length && (0, node_crypto_1.timingSafeEqual)(expected, recu))
|
|
74
|
+
valide = true;
|
|
75
|
+
}
|
|
76
|
+
if (!valide) {
|
|
72
77
|
throw new errors_js_1.TupaySignatureVerificationError('Signature invalide — la charge utile ne correspond pas au secret de cet endpoint.');
|
|
73
78
|
}
|
|
74
79
|
try {
|
package/dist/cjs/webhooks.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;
|
|
1
|
+
{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAuDH,wCA2DC;AAhHD,6CAAyD;AACzD,2CAA6D;AAG7D,uEAAuE;AAC1D,QAAA,yBAAyB,GAAG,GAAG,CAAA;AAmB5C,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,SAAS,GAAkB,IAAI,CAAA;IACnC,MAAM,EAAE,GAAa,EAAE,CAAA;IAEvB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,SAAS,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAA;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC9C,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS,GAAG,MAAM,CAAA;QACjD,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACxB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,KAAK,IAAI,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,cAAc,CAC5B,OAAwB,EACxB,MAAiC,EACjC,MAAc,EACd,UAAiC,EAAE;IAEnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,2CAA+B,CACvC,iFAAiF,CAClF,CAAA;IACH,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,2CAA+B,CACvC,+CAA+C,CAChD,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,2CAA+B,CACvC,wEAAwE,CACzE,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,iCAAyB,CAAA;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAC/D,IAAI,SAAS,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;QACjE,MAAM,IAAI,2CAA+B,CACvC,8BAA8B,SAAS,gDAAgD,CACxF,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtF,MAAM,CACP,CAAA;IAED,mEAAmE;IACnE,kEAAkE;IAClE,+DAA+D;IAC/D,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,MAAM,GAAG,IAAI,CAAA;IACvF,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,2CAA+B,CACvC,mFAAmF,CACpF,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAA;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,2CAA+B,CACvC,+DAA+D,CAChE,CAAA;IACH,CAAC;AACH,CAAC"}
|
|
@@ -19,7 +19,8 @@ export interface CreateAccountParams {
|
|
|
19
19
|
tgcRate?: TgcRate;
|
|
20
20
|
/**
|
|
21
21
|
* Coordonnées bancaires XPF du vendeur. Facultatives à la création —
|
|
22
|
-
* tant qu'elles manquent, `payoutsEnabled` est faux.
|
|
22
|
+
* tant qu'elles manquent, `payoutsEnabled` est faux. IBAN français ;
|
|
23
|
+
* la clé de contrôle est vérifiée, un caractère mal recopié est refusé.
|
|
23
24
|
*/
|
|
24
25
|
ibanXpf?: string;
|
|
25
26
|
/** Omise, le SDK génère un UUID v4 — la requête devient rejouable. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../../src/resources/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,UAAU,EACV,MAAM,EACN,OAAO,EACR,MAAM,aAAa,CAAA;AAEpB,MAAM,WAAW,mBAAmB;IAClC,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB
|
|
1
|
+
{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../../src/resources/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,UAAU,EACV,MAAM,EACN,OAAO,EACR,MAAM,aAAa,CAAA;AAEpB,MAAM,WAAW,mBAAmB;IAClC,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,QAAQ;IACP,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAE1C,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAWrD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ5C;;;;;;OAMG;IACH;;;;;;;;;;;OAWG;IACG,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAQ1D;;;;;;OAMG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,GAAE,UAAe,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAU7E,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;CAQ3C"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../../src/resources/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EACL,eAAe,EACf,eAAe,GAGhB,MAAM,aAAa,CAAA;
|
|
1
|
+
{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../../src/resources/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EACL,eAAe,EACf,eAAe,GAGhB,MAAM,aAAa,CAAA;AAmCpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,OAAO,QAAQ;IACU;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,KAAK,CAAC,MAAM,CAAC,MAA2B;QACtC,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;QAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAoB;YAC5D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,WAAW;YACjB,IAAI;YACJ,cAAc,EAAE,cAAc,IAAI,WAAW,CAAC,cAAc,EAAE;SAC/D,CAAC,CAAA;QACF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAoB;YAC5D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa,kBAAkB,CAAC,EAAE,CAAC,EAAE;SAC5C,CAAC,CAAA;QACF,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;OAMG;IACH;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,eAAe,CAAC,EAAU;QAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAA2B;YACnE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa,kBAAkB,CAAC,EAAE,CAAC,UAAU;SACpD,CAAC,CAAA;QACF,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,SAAqB,EAAE;QACnD,OAAO,eAAe,CACpB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAqB;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa,kBAAkB,CAAC,EAAE,CAAC,UAAU;YACnD,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC;SAC/B,CAAC,CACH,CAAA;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,eAAe,CACpB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB;YAC7C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,WAAW;SAClB,CAAC,CACH,CAAA;IACH,CAAC;CACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;
|
|
1
|
+
{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAgCD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,qBAA0B,GAClC,YAAY,CAsDd"}
|
package/dist/esm/webhooks.js
CHANGED
|
@@ -15,7 +15,7 @@ import { TupaySignatureVerificationError } from './errors.js';
|
|
|
15
15
|
export const DEFAULT_TOLERANCE_SECONDS = 300;
|
|
16
16
|
function parseHeader(header) {
|
|
17
17
|
let timestamp = null;
|
|
18
|
-
|
|
18
|
+
const v1 = [];
|
|
19
19
|
for (const part of header.split(',')) {
|
|
20
20
|
const separator = part.indexOf('=');
|
|
21
21
|
if (separator === -1)
|
|
@@ -28,10 +28,10 @@ function parseHeader(header) {
|
|
|
28
28
|
timestamp = parsed;
|
|
29
29
|
}
|
|
30
30
|
else if (key === 'v1') {
|
|
31
|
-
v1
|
|
31
|
+
v1.push(value);
|
|
32
32
|
}
|
|
33
33
|
}
|
|
34
|
-
return timestamp === null || v1 ===
|
|
34
|
+
return timestamp === null || v1.length === 0 ? null : { timestamp, v1 };
|
|
35
35
|
}
|
|
36
36
|
/**
|
|
37
37
|
* Vérifie la signature et renvoie l'événement typé.
|
|
@@ -59,12 +59,17 @@ export function constructEvent(payload, header, secret, options = {}) {
|
|
|
59
59
|
throw new TupaySignatureVerificationError(`Horodatage hors tolérance (${tolerance} s) — possible rejeu d’une livraison capturée.`);
|
|
60
60
|
}
|
|
61
61
|
const raw = typeof payload === 'string' ? payload : payload.toString('utf8');
|
|
62
|
-
const expected = createHmac('sha256', secret)
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
//
|
|
66
|
-
|
|
67
|
-
|
|
62
|
+
const expected = Buffer.from(createHmac('sha256', secret).update(`${parts.timestamp}.${raw}`, 'utf8').digest('hex'), 'utf8');
|
|
63
|
+
// UNE signature qui correspond suffit (renouvellement du secret en
|
|
64
|
+
// cours). Toutes sont comparées, sans sortie anticipée. Longueurs
|
|
65
|
+
// comparées d'abord : timingSafeEqual lève si elles diffèrent.
|
|
66
|
+
let valide = false;
|
|
67
|
+
for (const candidat of parts.v1) {
|
|
68
|
+
const recu = Buffer.from(candidat, 'utf8');
|
|
69
|
+
if (recu.length === expected.length && timingSafeEqual(expected, recu))
|
|
70
|
+
valide = true;
|
|
71
|
+
}
|
|
72
|
+
if (!valide) {
|
|
68
73
|
throw new TupaySignatureVerificationError('Signature invalide — la charge utile ne correspond pas au secret de cet endpoint.');
|
|
69
74
|
}
|
|
70
75
|
try {
|
package/dist/esm/webhooks.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAA;AAG7D,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAA;
|
|
1
|
+
{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAA;AAG7D,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAA;AAmB5C,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,SAAS,GAAkB,IAAI,CAAA;IACnC,MAAM,EAAE,GAAa,EAAE,CAAA;IAEvB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,SAAS,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAA;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC9C,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS,GAAG,MAAM,CAAA;QACjD,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACxB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,KAAK,IAAI,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAwB,EACxB,MAAiC,EACjC,MAAc,EACd,UAAiC,EAAE;IAEnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,+BAA+B,CACvC,iFAAiF,CAClF,CAAA;IACH,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,+BAA+B,CACvC,+CAA+C,CAChD,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,+BAA+B,CACvC,wEAAwE,CACzE,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,yBAAyB,CAAA;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAC/D,IAAI,SAAS,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;QACjE,MAAM,IAAI,+BAA+B,CACvC,8BAA8B,SAAS,gDAAgD,CACxF,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtF,MAAM,CACP,CAAA;IAED,mEAAmE;IACnE,kEAAkE;IAClE,+DAA+D;IAC/D,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,MAAM,GAAG,IAAI,CAAA;IACvF,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,+BAA+B,CACvC,mFAAmF,CACpF,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAA;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,+BAA+B,CACvC,+DAA+D,CAChE,CAAA;IACH,CAAC;AACH,CAAC"}
|