replicate/replicate-javascript

Document how to validate webhooks if your app is not using Request™

zeke opened this issue · 2 comments

zeke commented

From @aron in #259 (comment)

We should cover what to do if your environment doesn't support Request, in which case you pass through the parts manually:

const requestData = {
  id: "123",          // the `Webhook-Id` header
  timestamp: 0123456, // the `Webhook-Timestamp` header
  signature: "xyz",   // the `Webhook-Signature` header
  body: "",           // the request body as a string, ArrayBuffer or ReadableStream 
};
const webhookIsValid = await validateWebhook(requestData, secret);
mattt commented

FYI - The supported / expected argument types are documented here:

/**
* @see {@link validateWebhook}
* @overload
* @param {object} requestData - The request data
* @param {string} requestData.id - The webhook ID header from the incoming request.
* @param {string} requestData.timestamp - The webhook timestamp header from the incoming request.
* @param {string} requestData.body - The raw body of the incoming webhook request.
* @param {string} requestData.secret - The webhook secret, obtained from `replicate.webhooks.defaul.secret` method.
* @param {string} requestData.signature - The webhook signature header from the incoming request, comprising one or more space-delimited signatures.
*/
/**
* @see {@link validateWebhook}
* @overload
* @param {object} requestData - The request object
* @param {object} requestData.headers - The request headers
* @param {string} requestData.headers["webhook-id"] - The webhook ID header from the incoming request
* @param {string} requestData.headers["webhook-timestamp"] - The webhook timestamp header from the incoming request
* @param {string} requestData.headers["webhook-signature"] - The webhook signature header from the incoming request, comprising one or more space-delimited signatures
* @param {string} requestData.body - The raw body of the incoming webhook request
* @param {string} secret - The webhook secret, obtained from `replicate.webhooks.defaul.secret` method
*/
/**
* Validate a webhook signature
*
* @returns {Promise<boolean>} - True if the signature is valid
* @throws {Error} - If the request is missing required headers, body, or secret
*/

mattt commented

Thanks for your help with this, @aron 😄