Matt
221ae5784e
Bundles the prior autonomous-session output that was sitting unstaged: - Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances) - country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk after the per-subpath dynamic-import approach silently failed in webpack) - Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index, redirects (ocr to ai, reports to dashboard, invitations to users), docs/admin-ia-proposal.md - Per-template email tester (registry + endpoint + UI on Email admin page) - Cancel-document mode picker (delete-from-Documenso vs keep-for-audit) - Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers - Customize-widgets per-region sortables at xl+ (charts/rails/feed); single flat sortable below xl when the layout stacks; per-viewport saved orders - Audit doc updates capturing each shipped item - Lint fixes: react-compiler immutability in DonutChart (reduce instead of let-reassign), set-state-in-effect disables in CountryFlag and UploadForSigning preview-bytes effect, unused 'confirm' destructures in interest contract + reservation tabs, unescaped apostrophe in test-template card copy
22 lines
988 B
TypeScript
22 lines
988 B
TypeScript
import { timingSafeEqual } from 'crypto';
|
|
|
|
// Documenso (v1.13 + 2.x) authenticates outbound webhooks by sending the
|
|
// configured secret in plaintext via the `X-Documenso-Secret` header.
|
|
// There is no HMAC. Compare the provided value timing-safely to the env secret.
|
|
//
|
|
// An empty `expected` MUST always reject - without this guard,
|
|
// timingSafeEqual(0-bytes, 0-bytes) returns true, so a dev environment
|
|
// with a blank DOCUMENSO_WEBHOOK_SECRET would accept any request whose
|
|
// `X-Documenso-Secret` was also empty/missing. Same for blank per-port
|
|
// secret rows in `system_settings` (the per-port writer should never
|
|
// store an empty string but defense-in-depth here is cheap).
|
|
export function verifyDocumensoSecret(provided: string, expected: string): boolean {
|
|
if (!provided || !expected) return false;
|
|
if (provided.length !== expected.length) return false;
|
|
try {
|
|
return timingSafeEqual(Buffer.from(provided), Buffer.from(expected));
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|