@unito/integration-sdk/dist/src/eslint/rules/webhook-handler-requires-signature-verification.d.ts

Integration SDK

/**
 * Flags webhook PARSE handlers that have no signature-verification import.
 * Webhook payloads are provider-controlled untrusted strings; the default
 * generated shape is "parse the body, return impactedItems" which silently
 * drops the verifier step.
 *
 * Scope (any of):
 *   - filename matches /webhookParse\.ts$/i, /parseWebhooks?\.ts$/i,
 *     /webhooksParse\.ts$/i
 *   - any file that imports `ParseWebhooksHandler` from `@unito/integration-sdk`
 *     or `@unito/integration-api`
 *
 * `AcknowledgeWebhooksHandler` exports are out of scope (handshake response,
 * not payload parser).
 *
 * Opt-out: JSDoc `/** @webhook-no-signature: <reason>  *\/` above the export.
 *
 * Detection limitation (v1): only matches `ImportSpecifier` named imports for
 * SDK verifiers (`import { verifyWebhookSignature } from ...`). Default or
 * namespace imports are NOT detected; if the SDK exposes the verifier those
 * ways, use the JSDoc opt-out and document the reason.
 */
import type { Rule } from 'eslint';
declare const rule: Rule.RuleModule;
export default rule;