webhook-platform 2.5.0__tar.gz → 2.6.0__tar.gz

{webhook_platform-2.5.0 → webhook_platform-2.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webhook-platform
-Version: 2.5.0
+Version: 2.6.0
 Summary: Official Python SDK for Hookflow — reliable webhook infrastructure
 Author-email: Vadym Kykalo <vadymkykalo@gmail.com>
 License: MIT

{webhook_platform-2.5.0 → webhook_platform-2.6.0}/hookflow/__init__.py

@@ -36,7 +36,7 @@ from .types import (
     ReplayEventResponse,
 )
 
-__version__ = "2.5.0"
+__version__ = "2.6.0"
 
 # Backward-compatible aliases
 WebhookPlatform = Hookflow

{webhook_platform-2.5.0 → webhook_platform-2.6.0}/hookflow/client.py

@@ -37,7 +37,7 @@ from .errors import (
 
 DEFAULT_BASE_URL = "http://localhost:8080"
 DEFAULT_TIMEOUT = 30
-SDK_VERSION = "2.5.0"
+SDK_VERSION = "2.6.0"
 
 
 class Hookflow:

{webhook_platform-2.5.0 → webhook_platform-2.6.0}/hookflow/webhooks.py

@@ -20,9 +20,16 @@ def verify_signature(
     """
     Verify webhook signature using HMAC-SHA256.
 
+    The header is ``t=<unix-ms>,v1=<hex>`` and may carry more than one ``v1``.
+    After you rotate an endpoint's secret, Hookflow signs each delivery with both
+    the new secret and the retired one for the endpoint's grace window (24 hours
+    by default), so the new secret can be deployed whenever you like rather than
+    at the instant you press rotate. The delivery is authentic if *any* ``v1``
+    matches.
+
     Args:
         payload: Raw request body as string
-        signature: X-Signature header value (format: t=timestamp,v1=signature)
+        signature: X-Signature header value (format: t=timestamp,v1=signature[,v1=...])
         secret: Endpoint webhook secret
         tolerance_ms: Maximum age of signature in milliseconds
 
@@ -39,17 +46,20 @@ def verify_signature(
 
     # Parse signature
     timestamp: Optional[str] = None
-    sig: Optional[str] = None
+    # Collected, not overwritten: a header sent during a secret rotation carries one
+    # v1 per valid secret, and keeping only the last would reject whichever of the
+    # pair the receiver is currently holding.
+    signatures: list[str] = []
 
     for part in signature.split(","):
         if "=" in part:
             key, value = part.split("=", 1)
             if key == "t":
-                timestamp = value
+                timestamp = value.strip()
             elif key == "v1":
-                sig = value
+                signatures.append(value.strip())
 
-    if not timestamp or not sig:
+    if not timestamp or not signatures:
         raise HookflowError(
             "Invalid signature format. Expected: t=timestamp,v1=signature",
             400,
@@ -75,7 +85,14 @@ def verify_signature(
         hashlib.sha256,
     ).hexdigest()
 
-    if not hmac.compare_digest(sig, expected_signature):
+    # Every candidate is compared, with no early exit, so the time taken does not
+    # depend on which position matched.
+    matched = False
+    for candidate in signatures:
+        if hmac.compare_digest(candidate, expected_signature):
+            matched = True
+
+    if not matched:
         raise HookflowError("Invalid signature", 400, "invalid_signature")
 
     return True

{webhook_platform-2.5.0 → webhook_platform-2.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "webhook-platform"
-version = "2.5.0"
+version = "2.6.0"
 description = "Official Python SDK for Hookflow — reliable webhook infrastructure"
 readme = "README.md"
 license = {text = "MIT"}

{webhook_platform-2.5.0 → webhook_platform-2.6.0}/tests/test_webhooks.py

@@ -81,6 +81,49 @@ class TestVerifySignature:
         
         assert verify_signature(payload, signature, secret) is True
 
+    def test_verifies_either_signature_during_a_secret_rotation(self):
+        """A header carrying two v1 values verifies with either secret.
+
+        After a rotation Hookflow signs each delivery with the new secret and the
+        retired one for the grace window, so a receiver that has not deployed the new
+        secret yet keeps working. Before this, the parser kept only the last v1 and
+        rejected whichever half of the pair the receiver was holding.
+        """
+        payload = '{"type": "order.completed"}'
+        new_secret, retired_secret = "whsec_new", "whsec_retired"
+        timestamp = int(time.time() * 1000)
+        header = "{},v1={}".format(
+            generate_signature(payload, new_secret, timestamp),
+            generate_signature(payload, retired_secret, timestamp).split("v1=")[1],
+        )
+
+        assert verify_signature(payload, header, new_secret) is True
+        assert verify_signature(payload, header, retired_secret) is True
+
+    def test_two_signatures_still_reject_an_unrelated_secret(self):
+        """Accepting any v1 must not become accepting anything."""
+        payload = '{"type": "order.completed"}'
+        timestamp = int(time.time() * 1000)
+        header = "{},v1={}".format(
+            generate_signature(payload, "whsec_new", timestamp),
+            generate_signature(payload, "whsec_retired", timestamp).split("v1=")[1],
+        )
+
+        with pytest.raises(HookflowError):
+            verify_signature(payload, header, "whsec_someone_else")
+
+    def test_two_signatures_still_reject_a_tampered_body(self):
+        """Two signatures must not weaken body integrity."""
+        payload = '{"type": "order.completed"}'
+        timestamp = int(time.time() * 1000)
+        header = "{},v1={}".format(
+            generate_signature(payload, "whsec_new", timestamp),
+            generate_signature(payload, "whsec_retired", timestamp).split("v1=")[1],
+        )
+
+        with pytest.raises(HookflowError):
+            verify_signature(payload + " ", header, "whsec_new")
+
     def test_raises_on_missing_signature(self):
         """Should raise on missing signature."""
         with pytest.raises(HookflowError) as exc:

{webhook_platform-2.5.0 → webhook_platform-2.6.0}/webhook_platform.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webhook-platform
-Version: 2.5.0
+Version: 2.6.0
 Summary: Official Python SDK for Hookflow — reliable webhook infrastructure
 Author-email: Vadym Kykalo <vadymkykalo@gmail.com>
 License: MIT