relayed 0.0.3__tar.gz → 0.1.0__tar.gz

{relayed-0.0.3 → relayed-0.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: relayed
-Version: 0.0.3
+Version: 0.1.0
 Summary: Python client for Relayed, a webhook delivery service
 Project-URL: Homepage, https://github.com/JoeCosta7/Relayed
 Author-email: Joseph Costa <joedc3711@gmail.com>

{relayed-0.0.3 → relayed-0.1.0}/src/relayed/__init__.py

@@ -6,7 +6,10 @@ from relayed._errors import (
     RelayedConflictError,
     RelayedClientError,
     RelayedServerError,
+    RelayedTimestampError,
+    RelayedSignatureError
 )
+from relayed._webhooks import verify_webhook
 
 __all__ = [
     "RelayedClient",
@@ -16,6 +19,9 @@ __all__ = [
     "RelayedConflictError",
     "RelayedClientError",
     "RelayedServerError",
+    "RelayedTimestampError",
+    "RelayedSignatureError",
+    "verify_webhook"
 ]
 
 from importlib.metadata import version

{relayed-0.0.3 → relayed-0.1.0}/src/relayed/_errors.py

@@ -21,3 +21,8 @@ class RelayedClientError(RelayedError):
 class RelayedServerError(RelayedError):
     """5xx — something went wrong on Relayed's end."""
 
+class RelayedTimestampError(RelayedError):
+    """Raised when the timestamp of the webhook is outside the allowed tolerance."""
+
+class RelayedSignatureError(RelayedError):
+    """Raised when the signature of the webhook does not match the expected signature."""

relayed-0.1.0/src/relayed/_webhooks.py

@@ -0,0 +1,19 @@
+
+from datetime import datetime, timezone
+import hmac
+
+from ._errors import RelayedTimestampError, RelayedSignatureError
+
+def verify_webhook(body: bytes,signature: str,timestamp: str,secret: str,tolerance_seconds: int = 300,) -> None:
+    try:   
+        timestamp_int = int(timestamp)
+    except (ValueError, TypeError):
+        raise RelayedTimestampError("Webhook timestamp is missing or invalid.")
+    current_timestamp = int(datetime.now(timezone.utc).timestamp())
+    if abs(current_timestamp - timestamp_int) > tolerance_seconds:
+        raise RelayedTimestampError("Webhook timestamp is outside the allowed tolerance.")
+    reconstructed_payload = str(timestamp_int).encode("utf-8") + b"." + body
+    expected_signature = hmac.new(secret.encode(), reconstructed_payload, digestmod="sha256").hexdigest()
+    if not hmac.compare_digest(expected_signature, signature):
+        raise RelayedSignatureError("Webhook signature does not match the expected signature.")
+    return None

relayed-0.1.0/tests/test_webhooks.py

@@ -0,0 +1,62 @@
+import hmac
+from datetime import datetime, timezone
+
+import pytest
+
+from relayed._webhooks import verify_webhook
+from relayed import RelayedSignatureError, RelayedTimestampError
+
+
+def _sign(body: bytes, timestamp: int, secret: str) -> str:
+    """Produce the signature the worker would produce for this timestamp+body."""
+    signed_payload = str(timestamp).encode("utf-8") + b"." + body
+    return hmac.new(secret.encode(), signed_payload, digestmod="sha256").hexdigest()
+
+
+def _now() -> int:
+    return int(datetime.now(timezone.utc).timestamp())
+
+
+SECRET = "test-webhook-secret"
+
+
+def test_verify_webhook_happy_path():
+    """A correctly-signed webhook with a fresh timestamp verifies without raising."""
+    body = b'{"event": "delivery.succeeded"}'
+    timestamp = _now()
+    signature = _sign(body, timestamp, SECRET)
+    assert verify_webhook(body, signature, str(timestamp), SECRET) is None
+
+
+@pytest.mark.parametrize("bad_timestamp", ["", "abc", "1234abc", None])
+def test_verify_webhook_invalid_timestamp_format(bad_timestamp):
+    """Malformed timestamp values raise RelayedTimestampError."""
+    body = b'{"event": "delivery.succeeded"}'
+    with pytest.raises(RelayedTimestampError):
+        verify_webhook(body, "0" * 64, bad_timestamp, SECRET)
+
+
+def test_verify_webhook_timestamp_too_old():
+    """A timestamp more than tolerance_seconds in the past raises RelayedTimestampError."""
+    body = b'{"event": "delivery.succeeded"}'
+    timestamp = _now() - 400
+    signature = _sign(body, timestamp, SECRET)
+    with pytest.raises(RelayedTimestampError):
+        verify_webhook(body, signature, str(timestamp), SECRET)
+
+
+def test_verify_webhook_timestamp_too_new():
+    """A timestamp more than tolerance_seconds in the future raises RelayedTimestampError."""
+    body = b'{"event": "delivery.succeeded"}'
+    timestamp = _now() + 400
+    signature = _sign(body, timestamp, SECRET)
+    with pytest.raises(RelayedTimestampError):
+        verify_webhook(body, signature, str(timestamp), SECRET)
+
+
+def test_verify_webhook_bad_signature():
+    """A well-formed but incorrect signature raises RelayedSignatureError."""
+    body = b'{"event": "delivery.succeeded"}'
+    timestamp = _now()
+    with pytest.raises(RelayedSignatureError):
+        verify_webhook(body, "0" * 64, str(timestamp), SECRET)