chore(deps): bump svix to 1.99.1 and cover webhook signature verification

package.json

@@ -1,6 +1,6 @@
 {
     "name": "@blindpay/node",
-    "version": "5.0.0",
+    "version": "5.0.1",
     "description": "Official Node.js SDK for Blindpay API - Stablecoin API for global payments",
     "keywords": [
         "blindpay",
@@ -63,6 +63,6 @@
     },
     "packageManager": "bun@1.2.18",
     "dependencies": {
-        "svix": "1.94.0"
+        "svix": "1.99.1"
     }
 }

src/client.test.ts

@@ -1,3 +1,4 @@
+import { Webhook } from "svix";
 import { afterEach, describe, expect, it } from "vitest";
 import { BlindPay } from "./client";
 
@@ -15,3 +16,63 @@ describe("BlindPay client", () => {
         expect(data).toBeNull();
     });
 });
+
+describe("verifyWebhookSignature", () => {
+    const secret = "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw";
+    const payload = JSON.stringify({ type: "payout.complete", data: { id: "po_000000000000" } });
+    const id = "msg_000000000000";
+    const timestamp = new Date();
+
+    const blindpay = new BlindPay({ apiKey: "test-key", instanceId: "in_000000000000" });
+    const sign = (body: string) => new Webhook(secret).sign(id, timestamp, body);
+    const headers = (signature: string) => ({
+        id,
+        timestamp: Math.floor(timestamp.getTime() / 1000).toString(),
+        signature,
+    });
+
+    it("accepts a signature produced for the same payload", () => {
+        expect(
+            blindpay.verifyWebhookSignature({ secret, headers: headers(sign(payload)), payload })
+        ).toBe(true);
+    });
+
+    it("rejects a signature produced for a different payload", () => {
+        expect(
+            blindpay.verifyWebhookSignature({
+                secret,
+                headers: headers(sign(payload)),
+                payload: `${payload} `,
+            })
+        ).toBe(false);
+    });
+
+    it("rejects a signature made with a different secret", () => {
+        const other = new Webhook("whsec_TWFjaGluZUxlYXJuaW5nUm9ja3NOb3RSZWFsbHk=").sign(
+            id,
+            timestamp,
+            payload
+        );
+
+        expect(blindpay.verifyWebhookSignature({ secret, headers: headers(other), payload })).toBe(
+            false
+        );
+    });
+
+    it("rejects a timestamp outside the tolerated window", () => {
+        const stale = new Date(timestamp.getTime() - 60 * 60 * 1000);
+        const signature = new Webhook(secret).sign(id, stale, payload);
+
+        expect(
+            blindpay.verifyWebhookSignature({
+                secret,
+                headers: {
+                    id,
+                    timestamp: Math.floor(stale.getTime() / 1000).toString(),
+                    signature,
+                },
+                payload,
+            })
+        ).toBe(false);
+    });
+});