MT-22022: Add webhook signature verification helper#130
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughThis PR adds webhook signature verification to the Mailtrap SDK. A new ChangesWebhook Signature Verification Feature
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsStopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Rabsztok
force-pushed
the
MT-22022-webhook-signature-verification
branch
from
b8a48e6 to
2bad438
Compare
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/webhooks/verify-signature.ts`:
- Around line 50-52: The payload-type check in verifySignature (the function
handling parameters payload, signature, secret) currently allows empty
strings/Buffers; update the guard so that it also rejects empty payloads by
returning false when payload is an empty string (payload.length === 0) or an
empty Buffer (payload.length === 0) in addition to the existing
typeof/Buffer.isBuffer checks; keep the existing type check logic but add the
emptiness condition so empty inputs explicitly return false.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9d01f3a3-563c-4243-8f35-779cff4476d0
📒 Files selected for processing (5)
README.mdexamples/webhooks/verify-signature.tssrc/__tests__/lib/webhooks/verify-signature.test.tssrc/index.tssrc/lib/webhooks/verify-signature.ts
Add `verifyWebhookSignature(payload, signature, signingSecret)` exported
from the package root for verifying Mailtrap webhook signatures using
HMAC-SHA256 over the raw request body with constant-time hex comparison
via `crypto.timingSafeEqual`.
Returns false (no throw) for missing/empty/malformed/wrong-length
signatures so a single guard at the request handler covers every bad-input
case. Accepts `string | Buffer` payloads; signed input must be the raw
body bytes — the README and example warn against `express.json()` and show
the `express.raw({type: 'application/json'})` pattern.
Includes the shared cross-SDK test fixture (payload + secret + expected
signature) that all six Mailtrap SDKs use to stay byte-for-byte
compatible, plus a runnable Express receiver example and README
subsection.
See https://railsware.atlassian.net/browse/MT-22022
Rabsztok
force-pushed
the
MT-22022-webhook-signature-verification
branch
from
2bad438 to
eaab34a
Compare
1 participant
Motivation
Expose a helper so Node.js users don't have to re-implement Mailtrap's HMAC-SHA256 webhook signature check on every receiver.
Changes
verifyWebhookSignature(payload, signature, signingSecret)exported from the package root. HMAC-SHA256 over the raw body, constant-time compare viacrypto.timingSafeEqual. Acceptspayloadasstring | Buffer. Returnsfalse(never throws) on empty / wrong-length / non-hex / wrong-type inputs.src/__tests__/lib/webhooks/verify-signature.test.tspins the cross-SDK fixture (payload + signing_secret + expected digest) shared verbatim across all six official Mailtrap SDKs to guarantee byte-for-byte parity.examples/webhooks/verify-signature.ts— runnable usage snippet.How to test
CI runs jest, eslint, and tsc. Manually:
The script should exit 0 with no output.
Companion PRs
Coordinated rollout across all six official SDKs (same algorithm, same shared fixture):
Summary by CodeRabbit
Release Notes
New Features
Documentation
Tests