1
import type { WebhookProviderCatalogEntry } from "@/lib/webhooks";
2
import type { WebhookProvider as WebhookProviderValue } from "@/contracts";
3
import type { WebhookTriggerPayload } from "@/worker/contracts";
4
import { decryptSecret } from "@/worker/security/secrets";
5
import { timingSafeEqual, toArrayBuffer } from "@/worker/services/crypto";
6
import type { WebhookVerificationMaterial } from "@/worker/durable/project-do/webhooks/types";
7
import { HttpError } from "@/worker/http";
8
 
9
import { parseJsonObject, webhookPayloadNormalizers } from "./payload";
10
import { readWebhookRequestHeaders } from "./request";
11
 
12
const textEncoder = new TextEncoder();
13
 
14
const fromHex = (value: string): Uint8Array => {
15
  if (value.length % 2 !== 0 || !/^[0-9a-f]+$/iu.test(value)) {
16
    throw new HttpError(401, "invalid_webhook_signature", "Webhook signature is invalid.");
17
  }
18
 
19
  const output = new Uint8Array(value.length / 2);
20
  for (let index = 0; index < value.length; index += 2) {
21
    output[index / 2] = Number.parseInt(value.slice(index, index + 2), 16);
22
  }
23
 
24
  return output;
25
};
26
 
27
const verifySharedSecret = (provided: string, expected: string): void => {
28
  if (!timingSafeEqual(textEncoder.encode(provided), textEncoder.encode(expected))) {
29
    throw new HttpError(401, "invalid_webhook_signature", "Webhook signature is invalid.");
30
  }
31
};
32
 
33
const signHmacSha256 = async (secret: string, body: Uint8Array): Promise<Uint8Array> => {
34
  const key = await crypto.subtle.importKey(
35
    "raw",
36
    textEncoder.encode(secret),
37
    { name: "HMAC", hash: "SHA-256" },
38
    false,
39
    ["sign"],
40
  );
41
  const signature = await crypto.subtle.sign("HMAC", key, toArrayBuffer(body));
42
  return new Uint8Array(signature);
43
};
44
 
45
const verifyHmacSha256Hex = async (providedHex: string, secret: string, body: Uint8Array): Promise<void> => {
46
  const expected = await signHmacSha256(secret, body);
47
  const provided = fromHex(providedHex);
48
  if (!timingSafeEqual(provided, expected)) {
49
    throw new HttpError(401, "invalid_webhook_signature", "Webhook signature is invalid.");
50
  }
51
};
52
 
53
const verifyWebhookSignature = async (
54
  catalog: WebhookProviderCatalogEntry,
55
  verificationHeader: string,
56
  secret: string,
57
  body: Uint8Array,
58
): Promise<void> => {
59
  switch (catalog.verificationKind) {
60
    case "shared-secret":
61
      verifySharedSecret(verificationHeader, secret);
62
      return;
63
    case "hmac-sha256": {
64
      const providedHex =
65
        catalog.verificationPrefix === null
66
          ? verificationHeader
67
          : verificationHeader.startsWith(catalog.verificationPrefix)
68
            ? verificationHeader.slice(catalog.verificationPrefix.length)
69
            : null;
70
      if (providedHex === null) {
71
        throw new HttpError(401, "invalid_webhook_signature", "Webhook signature is invalid.");
72
      }
73
 
74
      await verifyHmacSha256Hex(providedHex, secret, body);
75
    }
76
  }
77
};
78
 
79
export const verifyProviderWebhook = async (
80
  provider: WebhookProviderValue,
81
  catalog: WebhookProviderCatalogEntry,
82
  env: Env,
83
  request: Request,
84
  material: WebhookVerificationMaterial,
85
  body: Uint8Array,
86
): Promise<WebhookTriggerPayload> => {
87
  const requestHeaders = readWebhookRequestHeaders(request, catalog);
88
  const secret = await decryptSecret(env, material.encryptedSecret);
89
  await verifyWebhookSignature(catalog, requestHeaders.verificationHeader, secret, body);
90
  const payload = parseJsonObject(body);
91
 
92
  return {
93
    ...webhookPayloadNormalizers[provider](payload, requestHeaders.eventName),
94
    deliveryId: requestHeaders.deliveryId,
95
  };
96
};