330 lines · 8 KBtext/plain; charset=utf-8
The Coline App SDK: apps, tools, file types and surfaces that run inside Coline workspaces, and public websites with Coline Sites. TypeScript, with an in-memory test workspace. MIT.
| 5 |
| COLINE_DELIVERY_HEADER, |
| 6 | verifyAppRequestSignature, |
| 7 | } from "./signing"; |
| 8 |
| 9 | // --------------------------------------------------------------------------- |
| 10 | // Webhook event types — discriminated union |
| 11 | // --------------------------------------------------------------------------- |
| 12 |
| 13 | interface WebhookEventBase { |
| 14 | deliveryId: string; |
| 15 | timestamp: string; |
| 16 | workspaceId: string; |
| 17 | /** Workspace details — included when delivered by the Coline platform. */ |
| 18 | workspace?: { |
| 19 | id: string; |
| 20 | slug: string; |
| 21 | name: string; |
| 22 | } | undefined; |
| 23 | } |
| 24 |
| 25 | export interface MessageCreatedEvent extends WebhookEventBase { |
| 26 | type: "message.created"; |
| 27 | data: { |
| 28 | messageId: string; |
| 29 | containerType: string; |
| 30 | containerId: string; |
| 31 | authorUserId: string | null; |
| 32 | plaintext: string; |
| 33 | }; |
| 34 | } |
| 35 |
| 36 | export interface MessageUpdatedEvent extends WebhookEventBase { |
| 37 | type: "message.updated"; |
| 38 | data: { |
| 39 | messageId: string; |
| 40 | containerType: string; |
| 41 | containerId: string; |
| 42 | plaintext: string; |
| 43 | }; |
| 44 | } |
| 45 |
| 46 | export interface MessageDeletedEvent extends WebhookEventBase { |
| 47 | type: "message.deleted"; |
| 48 | data: { |
| 49 | messageId: string; |
| 50 | containerType: string; |
| 51 | containerId: string; |
| 52 | }; |
| 53 | } |
| 54 |
| 55 | export interface ReactionAddedEvent extends WebhookEventBase { |
| 56 | type: "reaction.added"; |
| 57 | data: { |
| 58 | messageId: string; |
| 59 | userId: string; |
| 60 | emoji: string; |
| 61 | }; |
| 62 | } |
| 63 |
| 64 | export interface NoteCreatedEvent extends WebhookEventBase { |
| 65 | type: "note.created"; |
| 66 | data: { |
| 67 | noteId: string; |
| 68 | title: string; |
| 69 | createdByUserId: string | null; |
| 70 | }; |
| 71 | } |
| 72 |
| 73 | export interface NoteUpdatedEvent extends WebhookEventBase { |
| 74 | type: "note.updated"; |
| 75 | data: { |
| 76 | noteId: string; |
| 77 | title: string; |
| 78 | }; |
| 79 | } |
| 80 |
| 81 | export interface NoteDeletedEvent extends WebhookEventBase { |
| 82 | type: "note.deleted"; |
| 83 | data: { |
| 84 | noteId: string; |
| 85 | }; |
| 86 | } |
| 87 |
| 88 | export interface TaskCreatedEvent extends WebhookEventBase { |
| 89 | type: "task.created"; |
| 90 | data: { |
| 91 | taskId: string; |
| 92 | taskboardId: string; |
| 93 | title: string; |
| 94 | priority: string; |
| 95 | createdByUserId: string | null; |
| 96 | }; |
| 97 | } |
| 98 |
| 99 | export interface TaskUpdatedEvent extends WebhookEventBase { |
| 100 | type: "task.updated"; |
| 101 | data: { |
| 102 | taskId: string; |
| 103 | taskboardId: string; |
| 104 | title: string; |
| 105 | priority: string; |
| 106 | isCompleted: boolean; |
| 107 | }; |
| 108 | } |
| 109 |
| 110 | export interface TaskDeletedEvent extends WebhookEventBase { |
| 111 | type: "task.deleted"; |
| 112 | data: { |
| 113 | taskId: string; |
| 114 | taskboardId: string; |
| 115 | }; |
| 116 | } |
| 117 |
| 118 | export interface CalendarEventCreatedEvent extends WebhookEventBase { |
| 119 | type: "calendar_event.created"; |
| 120 | data: { |
| 121 | eventId: string; |
| 122 | title: string; |
| 123 | startTime: string; |
| 124 | endTime: string; |
| 125 | }; |
| 126 | } |
| 127 |
| 128 | export interface MemberJoinedEvent extends WebhookEventBase { |
| 129 | type: "member.joined"; |
| 130 | data: { |
| 131 | userId: string; |
| 132 | email: string; |
| 133 | roles: string[]; |
| 134 | }; |
| 135 | } |
| 136 |
| 137 | export interface MemberLeftEvent extends WebhookEventBase { |
| 138 | type: "member.left"; |
| 139 | data: { |
| 140 | userId: string; |
| 141 | }; |
| 142 | } |
| 143 |
| 144 | export interface GenericWebhookEvent extends WebhookEventBase { |
| 145 | type: string; |
| 146 | data: Record<string, unknown>; |
| 147 | } |
| 148 |
| 149 | /** |
| 150 | * All known webhook event types. Use `event.type` to narrow. |
| 151 | * |
| 152 | * @example |
| 153 | * ```ts |
| 154 | * const event = await coline.webhooks.constructEvent(body, headers, secret); |
| 155 | * |
| 156 | * switch (event.type) { |
| 157 | * case "message.created": |
| 158 | * console.log(event.data.plaintext); // typed! |
| 159 | * break; |
| 160 | * case "task.created": |
| 161 | * console.log(event.data.title, event.data.priority); // typed! |
| 162 | * break; |
| 163 | * } |
| 164 | * ``` |
| 165 | */ |
| 166 | export type WebhookEvent = |
| 167 | | MessageCreatedEvent |
| 168 | | MessageUpdatedEvent |
| 169 | | MessageDeletedEvent |
| 170 | | ReactionAddedEvent |
| 171 | | NoteCreatedEvent |
| 172 | | NoteUpdatedEvent |
| 173 | | NoteDeletedEvent |
| 174 | | TaskCreatedEvent |
| 175 | | TaskUpdatedEvent |
| 176 | | TaskDeletedEvent |
| 177 | | CalendarEventCreatedEvent |
| 178 | | MemberJoinedEvent |
| 179 | | MemberLeftEvent |
| 180 | | GenericWebhookEvent; |
| 181 |
| 182 | /** All known webhook event type strings. */ |
| 183 | export type WebhookEventType = WebhookEvent["type"]; |
| 184 |
| 185 | // --------------------------------------------------------------------------- |
| 186 | // Webhook handler helpers |
| 187 | // --------------------------------------------------------------------------- |
| 188 |
| 189 | const MAX_TIMESTAMP_DRIFT_MS = 5 * 60 * 1000; // 5 minutes |
| 190 |
| 191 | /** |
| 192 | * Webhook verification and event construction — inspired by Stripe's pattern. |
| 193 | * |
| 194 | * @example |
| 195 | * ```ts |
| 196 | * import { webhooks } from "@colineapp/sdk"; |
| 197 | * |
| 198 | * // In your webhook handler (Express, Hono, Next.js, etc.): |
| 199 | * const event = await webhooks.constructEvent( |
| 200 | * rawBody, // The raw request body string |
| 201 | * request.headers, // Headers object or Record<string, string> |
| 202 | * process.env.COLINE_WEBHOOK_SECRET, |
| 203 | * ); |
| 204 | * |
| 205 | * if (event.type === "message.created") { |
| 206 | * console.log(event.data.plaintext); |
| 207 | * } |
| 208 | * ``` |
| 209 | */ |
| 210 | export const webhooks = { |
| 211 | /** |
| 212 | * Verify a webhook signature and parse the typed event payload. |
| 213 | * |
| 214 | * @throws {ColineApiError} if signature is invalid, timestamp is too old, or payload is malformed. |
| 215 | */ |
| 216 | async constructEvent( |
| 217 | rawBody: string, |
| 218 | headers: Headers | Record<string, string | undefined>, |
| 219 | secret: string, |
| 220 | ): Promise<WebhookEvent> { |
| 221 | const getHeader = (name: string): string | undefined => { |
| 222 | if (headers instanceof Headers) { |
| 223 | return headers.get(name) ?? undefined; |
| 224 | } |
| 225 | return headers[name]; |
| 226 | }; |
| 227 |
| 228 | const signature = getHeader(COLINE_SIGNATURE_HEADER); |
| 229 | const timestamp = getHeader(COLINE_TIMESTAMP_HEADER); |
| 230 | const deliveryId = getHeader(COLINE_DELIVERY_HEADER); |
| 231 |
| 232 | if (!signature || !timestamp) { |
| 233 | throw new ColineApiError({ |
| 234 | message: "Missing webhook signature or timestamp headers.", |
| 235 | type: "network", |
| 236 | status: 0, |
| 237 | code: "WEBHOOK_MISSING_HEADERS", |
| 238 | }); |
| 239 | } |
| 240 |
| 241 | // Reject stale timestamps to prevent replay attacks |
| 242 | const timestampMs = new Date(timestamp).getTime(); |
| 243 | if ( |
| 244 | Number.isNaN(timestampMs) || |
| 245 | Math.abs(Date.now() - timestampMs) > MAX_TIMESTAMP_DRIFT_MS |
| 246 | ) { |
| 247 | throw new ColineApiError({ |
| 248 | message: "Webhook timestamp is too old or invalid. Possible replay attack.", |
| 249 | type: "network", |
| 250 | status: 0, |
| 251 | code: "WEBHOOK_TIMESTAMP_EXPIRED", |
| 252 | }); |
| 253 | } |
| 254 |
| 255 | const valid = await verifyAppRequestSignature({ |
| 256 | secret, |
| 257 | timestamp, |
| 258 | body: rawBody, |
| 259 | signature, |
| 260 | }); |
| 261 |
| 262 | if (!valid) { |
| 263 | throw new ColineApiError({ |
| 264 | message: "Webhook signature verification failed.", |
| 265 | type: "network", |
| 266 | status: 0, |
| 267 | code: "WEBHOOK_SIGNATURE_INVALID", |
| 268 | }); |
| 269 | } |
| 270 |
| 271 | const parsed = JSON.parse(rawBody) as Record<string, unknown>; |
| 272 |
| 273 | const workspaceId = (parsed["workspaceId"] as string) ?? ""; |
| 274 | const rawWorkspace = parsed["workspace"] as Record<string, unknown> | undefined; |
| 275 | const workspace = rawWorkspace |
| 276 | ? { |
| 277 | id: (rawWorkspace["id"] as string) ?? workspaceId, |
| 278 | slug: (rawWorkspace["slug"] as string) ?? "", |
| 279 | name: (rawWorkspace["name"] as string) ?? "", |
| 280 | } |
| 281 | : undefined; |
| 282 |
| 283 | return { |
| 284 | type: (parsed["type"] as string) ?? "unknown", |
| 285 | deliveryId: deliveryId ?? "", |
| 286 | timestamp, |
| 287 | workspaceId, |
| 288 | ...(workspace ? { workspace } : {}), |
| 289 | data: (parsed["data"] as Record<string, unknown>) ?? {}, |
| 290 | } as WebhookEvent; |
| 291 | }, |
| 292 |
| 293 | /** |
| 294 | * Verify a webhook signature without parsing the body. |
| 295 | * Returns `true` if valid, `false` otherwise. Does not throw. |
| 296 | */ |
| 297 | async verify( |
| 298 | rawBody: string, |
| 299 | headers: Headers | Record<string, string | undefined>, |
| 300 | secret: string, |
| 301 | ): Promise<boolean> { |
| 302 | const getHeader = (name: string): string | undefined => { |
| 303 | if (headers instanceof Headers) { |
| 304 | return headers.get(name) ?? undefined; |
| 305 | } |
| 306 | return headers[name]; |
| 307 | }; |
| 308 |
| 309 | const signature = getHeader(COLINE_SIGNATURE_HEADER); |
| 310 | const timestamp = getHeader(COLINE_TIMESTAMP_HEADER); |
| 311 |
| 312 | if (!signature || !timestamp) return false; |
| 313 |
| 314 | const timestampMs = new Date(timestamp).getTime(); |
| 315 | if ( |
| 316 | Number.isNaN(timestampMs) || |
| 317 | Math.abs(Date.now() - timestampMs) > MAX_TIMESTAMP_DRIFT_MS |
| 318 | ) { |
| 319 | return false; |
| 320 | } |
| 321 |
| 322 | return verifyAppRequestSignature({ |
| 323 | secret, |
| 324 | timestamp, |
| 325 | body: rawBody, |
| 326 | signature, |
| 327 | }); |
| 328 | }, |
| 329 | }; |
| 330 |