Skip to content

Add webhook signature verification examples and tests #24

@Lakes41

Description

@Lakes41

Summary

Strengthen the optional webhook utilities package by adding examples and tests for verifying incoming webhook payloads.

Current Behaviour

The README identifies packages/webhook-utils as optional, but the visible setup does not describe how dashboard or integration services should safely verify webhooks.

Expected Behaviour

The webhook utilities package should include tested verification helpers and copy-ready examples for Next.js route handlers or Node services.

Suggested Implementation

Inspect the current webhook utility implementation, add unit tests for valid signatures, invalid signatures, stale timestamps, malformed headers, and body tampering. Add a Next.js route-handler example showing safe raw-body handling.

Files or Areas Likely Affected

  • packages/webhook-utils/src/
  • packages/webhook-utils/package.json
  • packages/webhook-utils/test/
  • apps/dashboard/app/api/
  • README.md
  • docs/

Acceptance Criteria

  • Webhook verification tests cover valid and invalid signatures
  • Timestamp replay protection is tested if supported
  • Malformed or missing headers are handled safely
  • A Next.js-compatible example is documented
  • Tests can run through a workspace script
  • No webhook secret is exposed in examples

Additional Notes

Assumption: webhook verification is intended to be part of the broader integration surface. If the package is legacy-only, update documentation to clarify its support status.

Metadata

Metadata

Assignees

Labels

GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardOfficial CampaignCampaign: Official Campaign

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions