connect-sdk-nodejs/lib/webhooks/validation.js

SDK to communicate with the Worldline Global Collect platform using the Worldline Connect Server API

"use strict";
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
    return new (P || (P = Promise))(function (resolve, reject) {
        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
        step((generator = generator.apply(thisArg, _arguments || [])).next());
    });
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.newSignatureValidator = void 0;
const crypto = require("crypto");
const compare = require("secure-compare");
function getHeaderValue(requestHeaders, headerName) {
    const lowerCaseHeaderName = headerName.toLowerCase();
    for (const name in requestHeaders) {
        if (name != null && lowerCaseHeaderName === name.toLowerCase()) {
            const value = requestHeaders[name];
            if (typeof value === "string") {
                return value;
            }
            if (typeof value === "undefined") {
                throw new Error(`could not find header '${headerName}'`);
            }
            throw new Error(`found multiple values for header '${headerName}'`);
        }
    }
    throw new Error(`could not find header '${headerName}'`);
}
function validate(body, requestHeaders, secretKeyStore) {
    return __awaiter(this, void 0, void 0, function* () {
        const signature = getHeaderValue(requestHeaders, "X-GCS-Signature");
        const keyId = getHeaderValue(requestHeaders, "X-GCS-KeyId");
        const secretKey = yield secretKeyStore.getSecretKey(keyId);
        const expectedSignature = crypto
            .createHmac("sha256", secretKey)
            .update(body)
            .digest("base64");
        if (!compare(signature, expectedSignature)) {
            throw new Error(`failed to validate signature '${signature}'`);
        }
    });
}
function newSignatureValidator(store) {
    if (!store || typeof store.getSecretKey !== "function") {
        throw new Error("no valid secret key store given");
    }
    return {
        validate: (body, requestHeaders) => validate(body, requestHeaders, store)
    };
}
exports.newSignatureValidator = newSignatureValidator;
//# sourceMappingURL=validation.js.map