eve/dist/src/public/channels/linear/verify.js

Filesystem-first framework for durable backend AI agents that run anywhere.

import{createLogger}from"#internal/logging.js";import{isObject}from"#shared/guards.js";import{createHmac,timingSafeEqual}from"node:crypto";import{resolveLinearWebhookSecret}from"#public/channels/linear/auth.js";const log=createLogger(`linear.verify`);async function verifyLinearRequest(e,t){let n=await e.text();if(t.webhookVerifier!==void 0){let r=await t.webhookVerifier(e,n);if(!r)throw Error(`linearChannel: inbound webhook verifier rejected the request.`);return typeof r==`string`?r:n}let r=await resolveLinearWebhookSecret(t.webhookSecret),a=e.headers.get(`linear-signature`)??``;if(!a)throw Error(`linearChannel: inbound request missing Linear-Signature.`);if(!constantTimeCompare(signLinearWebhookBody(n,r),a))throw Error(`linearChannel: inbound request signature mismatch.`);return verifyWebhookTimestamp(n,t.maxSkewMs??6e4),n}function signLinearWebhookBody(e,t){return createHmac(`sha256`,t).update(e).digest(`hex`)}function verifyWebhookTimestamp(e,n){let r;try{r=JSON.parse(e)}catch{throw Error(`linearChannel: inbound request body is not valid JSON.`)}let i=isObject(r)?r.webhookTimestamp:void 0;if(typeof i!=`number`||!Number.isFinite(i))throw Error(`linearChannel: inbound request missing webhookTimestamp.`);if(Math.abs(Date.now()-i)>n)throw Error(`linearChannel: inbound request timestamp outside allowed skew.`)}function constantTimeCompare(e,t){if(e.length!==t.length)return!1;try{return timingSafeEqual(Buffer.from(e),Buffer.from(t))}catch(e){return log.debug(`timingSafeEqual threw`,{error:e}),!1}}export{signLinearWebhookBody,verifyLinearRequest};