Add support for validating webhooks

Author: mattt

index.js

@@ -9,6 +9,7 @@ const hardware = require("./lib/hardware");
 const models = require("./lib/models");
 const predictions = require("./lib/predictions");
 const trainings = require("./lib/trainings");
+const webhooks = require("./lib/webhooks");
 
 const packageJSON = require("./package.json");
 
@@ -85,6 +86,14 @@ class Replicate {
       cancel: trainings.cancel.bind(this),
       list: trainings.list.bind(this),
     };
+
+    this.webhooks = {
+      default: {
+        secrets: {
+          get: webhooks.default.secrets.get.bind(this),
+        },
+      },
+    };
   }
 
   /**

lib/util.js

@@ -1,5 +1,81 @@
+const crypto = require("node:crypto");
+
 const ApiError = require("./error");
 
+/**
+ * @see {@link validateWebhook}
+ * @overload
+ * @param {object} requestData - The request data
+ * @param {string} requestData.id - The webhook ID header from the incoming request.
+ * @param {string} requestData.timestamp - The webhook timestamp header from the incoming request.
+ * @param {string} requestData.body - The raw body of the incoming webhook request.
+ * @param {string} requestData.secret - The webhook secret, obtained from `replicate.webhooks.defaul.secret` method.
+ * @param {string} requestData.signature - The webhook signature header from the incoming request, comprising one or more space-delimited signatures.
+ */
+
+/**
+ * @see {@link validateWebhook}
+ * @overload
+ * @param {object} requestData - The request object
+ * @param {object} requestData.headers - The request headers
+ * @param {string} requestData.headers["webhook-id"] - The webhook ID header from the incoming request
+ * @param {string} requestData.headers["webhook-timestamp"] - The webhook timestamp header from the incoming request
+ * @param {string} requestData.headers["webhook-signature"] - The webhook signature header from the incoming request, comprising one or more space-delimited signatures
+ * @param {string} requestData.body - The raw body of the incoming webhook request
+ * @param {string} secret - The webhook secret, obtained from `replicate.webhooks.defaul.secret` method
+ */
+
+/**
+ * Validate a webhook signature
+ *
+ * @returns {boolean} - True if the signature is valid
+ * @throws {Error} - If the request is missing required headers, body, or secret
+ */
+function validateWebhook(requestData, secret) {
+  let { id, timestamp, body, signature } = requestData;
+  const signingSecret = secret || requestData.secret;
+
+  if (
+    requestData &&
+    requestData.headers &&
+    typeof requestData.body === "string"
+  ) {
+    id = requestData.headers["webhook-id"];
+    timestamp = requestData.headers["webhook-timestamp"];
+    signature = requestData.headers["webhook-signature"];
+    body = requestData.body;
+  }
+
+  if (!id || !timestamp || !signature) {
+    throw new Error("Missing required webhook headers");
+  }
+
+  if (!body) {
+    throw new Error("Missing required body");
+  }
+
+  if (!signingSecret) {
+    throw new Error("Missing required secret");
+  }
+
+  const signedContent = `${id}.${timestamp}.${body}`;
+
+  const secretBytes = Buffer.from(signingSecret.split("_")[1], "base64");
+
+  const computedSignature = crypto
+    .createHmac("sha256", secretBytes)
+    .update(signedContent)
+    .digest("base64");
+
+  const expectedSignatures = signature
+    .split(" ")
+    .map((sig) => sig.split(",")[1]);
+
+  return expectedSignatures.some(
+    (expectedSignature) => expectedSignature === computedSignature
+  );
+}
+
 /**
  * Automatically retry a request if it fails with an appropriate status code.
  *
@@ -68,4 +144,4 @@ async function withAutomaticRetries(request, options = {}) {
   return request();
 }
 
-module.exports = { withAutomaticRetries };
+module.exports = { validateWebhook, withAutomaticRetries };

lib/webhooks.js

@@ -0,0 +1,20 @@
+/**
+ * Get the default webhook signing secret
+ *
+ * @returns {Promise<object>} Resolves with the signing secret for the default webhook
+ */
+async function getDefaultWebhookSecret() {
+  const response = await this.request("/webhooks/default/secret", {
+    method: "GET",
+  });
+
+  return response.json();
+}
+
+module.exports = {
+  default: {
+    secrets: {
+      get: getDefaultWebhookSecret,
+    },
+  },
+};