Merge pull request #37 from pinax-network/webhook-signature

Update webhook signature

package.json

@@ -1,12 +1,12 @@
 {
   "private": true,
-  "version": "0.1.10",
+  "version": "0.2.0",
   "description": "Substreams Sink Websockets",
   "name": "substreams-sink-websockets",
   "homepage": "https://github.com/pinax-network/substreams-sink-websockets",
   "type": "module",
   "scripts": {
-    "start": "bun run index.ts --help",
+    "start": "bun run index.ts",
     "test": "bun test",
     "build": "bun build --compile ./index.ts --outfile substreams-sink-websockets",
     "dev": "bun run --watch index.ts"
@@ -16,12 +16,11 @@
     "dotenv": "latest",
     "openapi3-ts": "latest",
     "prom-client": "latest",
-    "substreams-sink-webhook": "^0.7.2",
-    "tslog": "latest",
-    "tweetnacl": "latest"
+    "substreams-sink-webhook": "^0.8",
+    "tslog": "latest"
   },
   "devDependencies": {
-    "bun-types": "latest",
+    "@types/bun": "latest",
     "typescript": "latest"
   }
 }

src/fetch/POST.ts

@@ -6,7 +6,6 @@ import { Server } from "bun";
 import { toText } from "./cors.js";
 import { insertMessages } from "./messages.js";
 import { signatureEd25519 } from "../webhook/singatureEd25519.js";
-import { BodySchema } from "substreams-sink-webhook/auth";
 
 export default async function (req: Request, server: Server) {
   // validate Ed25519 signature

src/webhook/singatureEd25519.ts

@@ -1,23 +1,25 @@
 import { PUBLIC_KEYS } from "../config.js";
 import { toText } from "../fetch/cors.js";
 import { Err, Ok, Result } from "../result.js";
-import { cachedVerify } from "substreams-sink-webhook/auth";
+import { verify } from "substreams-sink-webhook/auth";
 
-export async function signatureEd25519(req: Request, text: string): Promise<Result<undefined, Response>> {
+export async function signatureEd25519(req: Request, body: string): Promise<Result<undefined, Response>> {
   const signature = req.headers.get("x-signature-ed25519");
-  const expiry = req.headers.get("x-signature-ed25519-expiry");
-  const publicKey = req.headers.get("x-signature-ed25519-public-key");
+  const timestamp = Number(req.headers.get("x-signature-timestamp"));
 
   if (!signature) return Err(toText("missing required signature in headers", 400));
-  if (!expiry) return Err(toText("missing required expiry in headers", 400));
-  if (!publicKey) return Err(toText("missing required public key in headers", 400));
-  if (!text) return Err(toText("missing body", 400));
+  if (!timestamp) return Err(toText("missing required timestamp in headers", 400));
+  if (!body) return Err(toText("missing body", 400));
 
-  if (!PUBLIC_KEYS.includes(publicKey)) {
-    return Err(toText("invalid public key", 401));
+  let isVerified = false;
+  for ( const publicKey of PUBLIC_KEYS) {
+    if (verify(timestamp, body, signature, publicKey)) {
+      isVerified = true;
+      break;
+    }
   }
 
-  if (!cachedVerify(signature, Number(expiry), publicKey)) {
+  if (!isVerified) {
     return Err(toText("invalid request signature", 401));
   }
 

src/websocket/parseMessage.spec.ts

@@ -31,21 +31,21 @@ test("parseMessage - ping", () => {
         "method": "ping"
     }`)).toBeTruthy();
 
-    expect(parseMessage(`{
+    expect(Number(parseMessage(`{
         "id": 123,
         "method": "ping"
-    }`).id).toBe(123);
+    }`).id)).toBe(123);
 });
 
 test("parseMessage - time", () => {
     expect(parseMessage(`{
         "method": "time"
     }`)).toBeTruthy();
 
-    expect(parseMessage(`{
+    expect(Number(parseMessage(`{
         "id": 123,
         "method": "time"
-    }`).id).toBe(123);
+    }`).id)).toBe(123);
 });
 
 test("parseMessage - Missing required 'method' in JSON request.", () => {