The Coline App SDK: apps, tools, file types and surfaces that run inside Coline workspaces, and public websites with Coline Sites. TypeScript, with an in-memory test workspace. MIT.
| 5 |
| COLINE_DELIVERY_HEADER, |
| 6 | verifyAppRequestSignature, |
| 7 | } from "./signing"; |
| 8 |
| 9 | // --------------------------------------------------------------------------- |
| 10 | // Webhook event types — discriminated union |
| 11 | // --------------------------------------------------------------------------- |
| 12 |
| 13 | interface WebhookEventBase { |
| 14 | deliveryId: string; |
| 15 | timestamp: string; |
| 16 | workspaceId: string; |
| 17 | } |
| 18 |
| 19 | export interface MessageCreatedEvent extends WebhookEventBase { |
| 20 | type: "message.created"; |
| 21 | data: { |
| 22 | messageId: string; |
| 23 | containerType: string; |
| 24 | containerId: string; |
| 25 | authorUserId: string | null; |
| 26 | plaintext: string; |
| 27 | }; |
| 28 | } |
| 29 |
| 30 | export interface MessageUpdatedEvent extends WebhookEventBase { |
| 31 | type: "message.updated"; |
| 32 | data: { |
| 33 | messageId: string; |
| 34 | containerType: string; |
| 35 | containerId: string; |
| 36 | plaintext: string; |
| 37 | }; |
| 38 | } |
| 39 |
| 40 | export interface MessageDeletedEvent extends WebhookEventBase { |
| 41 | type: "message.deleted"; |
| 42 | data: { |
| 43 | messageId: string; |
| 44 | containerType: string; |
| 45 | containerId: string; |
| 46 | }; |
| 47 | } |
| 48 |
| 49 | export interface ReactionAddedEvent extends WebhookEventBase { |
| 50 | type: "reaction.added"; |
| 51 | data: { |
| 52 | messageId: string; |
| 53 | userId: string; |
| 54 | emoji: string; |
| 55 | }; |
| 56 | } |
| 57 |
| 58 | export interface NoteCreatedEvent extends WebhookEventBase { |
| 59 | type: "note.created"; |
| 60 | data: { |
| 61 | noteId: string; |
| 62 | title: string; |
| 63 | createdByUserId: string | null; |
| 64 | }; |
| 65 | } |
| 66 |
| 67 | export interface NoteUpdatedEvent extends WebhookEventBase { |
| 68 | type: "note.updated"; |
| 69 | data: { |
| 70 | noteId: string; |
| 71 | title: string; |
| 72 | }; |
| 73 | } |
| 74 |
| 75 | export interface NoteDeletedEvent extends WebhookEventBase { |
| 76 | type: "note.deleted"; |
| 77 | data: { |
| 78 | noteId: string; |
| 79 | }; |
| 80 | } |
| 81 |
| 82 | export interface TaskCreatedEvent extends WebhookEventBase { |
| 83 | type: "task.created"; |
| 84 | data: { |
| 85 | taskId: string; |
| 86 | taskboardId: string; |
| 87 | title: string; |
| 88 | priority: string; |
| 89 | createdByUserId: string | null; |
| 90 | }; |
| 91 | } |
| 92 |
| 93 | export interface TaskUpdatedEvent extends WebhookEventBase { |
| 94 | type: "task.updated"; |
| 95 | data: { |
| 96 | taskId: string; |
| 97 | taskboardId: string; |
| 98 | title: string; |
| 99 | priority: string; |
| 100 | isCompleted: boolean; |
| 101 | }; |
| 102 | } |
| 103 |
| 104 | export interface TaskDeletedEvent extends WebhookEventBase { |
| 105 | type: "task.deleted"; |
| 106 | data: { |
| 107 | taskId: string; |
| 108 | taskboardId: string; |
| 109 | }; |
| 110 | } |
| 111 |
| 112 | export interface CalendarEventCreatedEvent extends WebhookEventBase { |
| 113 | type: "calendar_event.created"; |
| 114 | data: { |
| 115 | eventId: string; |
| 116 | title: string; |
| 117 | startTime: string; |
| 118 | endTime: string; |
| 119 | }; |
| 120 | } |
| 121 |
| 122 | export interface MemberJoinedEvent extends WebhookEventBase { |
| 123 | type: "member.joined"; |
| 124 | data: { |
| 125 | userId: string; |
| 126 | email: string; |
| 127 | roles: string[]; |
| 128 | }; |
| 129 | } |
| 130 |
| 131 | export interface MemberLeftEvent extends WebhookEventBase { |
| 132 | type: "member.left"; |
| 133 | data: { |
| 134 | userId: string; |
| 135 | }; |
| 136 | } |
| 137 |
| 138 | export interface GenericWebhookEvent extends WebhookEventBase { |
| 139 | type: string; |
| 140 | data: Record<string, unknown>; |
| 141 | } |
| 142 |
| 143 | /** |
| 144 | * All known webhook event types. Use `event.type` to narrow. |
| 145 | * |
| 146 | * @example |
| 147 | * ```ts |
| 148 | * const event = await coline.webhooks.constructEvent(body, headers, secret); |
| 149 | * |
| 150 | * switch (event.type) { |
| 151 | * case "message.created": |
| 152 | * console.log(event.data.plaintext); // typed! |
| 153 | * break; |
| 154 | * case "task.created": |
| 155 | * console.log(event.data.title, event.data.priority); // typed! |
| 156 | * break; |
| 157 | * } |
| 158 | * ``` |
| 159 | */ |
| 160 | export type WebhookEvent = |
| 161 | | MessageCreatedEvent |
| 162 | | MessageUpdatedEvent |
| 163 | | MessageDeletedEvent |
| 164 | | ReactionAddedEvent |
| 165 | | NoteCreatedEvent |
| 166 | | NoteUpdatedEvent |
| 167 | | NoteDeletedEvent |
| 168 | | TaskCreatedEvent |
| 169 | | TaskUpdatedEvent |
| 170 | | TaskDeletedEvent |
| 171 | | CalendarEventCreatedEvent |
| 172 | | MemberJoinedEvent |
| 173 | | MemberLeftEvent |
| 174 | | GenericWebhookEvent; |
| 175 |
| 176 | /** All known webhook event type strings. */ |
| 177 | export type WebhookEventType = WebhookEvent["type"]; |
| 178 |
| 179 | // --------------------------------------------------------------------------- |
| 180 | // Webhook handler helpers |
| 181 | // --------------------------------------------------------------------------- |
| 182 |
| 183 | const MAX_TIMESTAMP_DRIFT_MS = 5 * 60 * 1000; // 5 minutes |
| 184 |
| 185 | /** |
| 186 | * Webhook verification and event construction — inspired by Stripe's pattern. |
| 187 | * |
| 188 | * @example |
| 189 | * ```ts |
| 190 | * import { webhooks } from "@colineapp/sdk"; |
| 191 | * |
| 192 | * // In your webhook handler (Express, Hono, Next.js, etc.): |
| 193 | * const event = await webhooks.constructEvent( |
| 194 | * rawBody, // The raw request body string |
| 195 | * request.headers, // Headers object or Record<string, string> |
| 196 | * process.env.COLINE_WEBHOOK_SECRET, |
| 197 | * ); |
| 198 | * |
| 199 | * if (event.type === "message.created") { |
| 200 | * console.log(event.data.plaintext); |
| 201 | * } |
| 202 | * ``` |
| 203 | */ |
| 204 | export const webhooks = { |
| 205 | /** |
| 206 | * Verify a webhook signature and parse the typed event payload. |
| 207 | * |
| 208 | * @throws {ColineApiError} if signature is invalid, timestamp is too old, or payload is malformed. |
| 209 | */ |
| 210 | async constructEvent( |
| 211 | rawBody: string, |
| 212 | headers: Headers | Record<string, string | undefined>, |
| 213 | secret: string, |
| 214 | ): Promise<WebhookEvent> { |
| 215 | const getHeader = (name: string): string | undefined => { |
| 216 | if (headers instanceof Headers) { |
| 217 | return headers.get(name) ?? undefined; |
| 218 | } |
| 219 | return headers[name]; |
| 220 | }; |
| 221 |
| 222 | const signature = getHeader(COLINE_SIGNATURE_HEADER); |
| 223 | const timestamp = getHeader(COLINE_TIMESTAMP_HEADER); |
| 224 | const deliveryId = getHeader(COLINE_DELIVERY_HEADER); |
| 225 |
| 226 | if (!signature || !timestamp) { |
| 227 | throw new ColineApiError({ |
| 228 | message: "Missing webhook signature or timestamp headers.", |
| 229 | type: "network", |
| 230 | status: 0, |
| 231 | code: "WEBHOOK_MISSING_HEADERS", |
| 232 | }); |
| 233 | } |
| 234 |
| 235 | // Reject stale timestamps to prevent replay attacks |
| 236 | const timestampMs = new Date(timestamp).getTime(); |
| 237 | if ( |
| 238 | Number.isNaN(timestampMs) || |
| 239 | Math.abs(Date.now() - timestampMs) > MAX_TIMESTAMP_DRIFT_MS |
| 240 | ) { |
| 241 | throw new ColineApiError({ |
| 242 | message: "Webhook timestamp is too old or invalid. Possible replay attack.", |
| 243 | type: "network", |
| 244 | status: 0, |
| 245 | code: "WEBHOOK_TIMESTAMP_EXPIRED", |
| 246 | }); |
| 247 | } |
| 248 |
| 249 | const valid = await verifyAppRequestSignature({ |
| 250 | secret, |
| 251 | timestamp, |
| 252 | body: rawBody, |
| 253 | signature, |
| 254 | }); |
| 255 |
| 256 | if (!valid) { |
| 257 | throw new ColineApiError({ |
| 258 | message: "Webhook signature verification failed.", |
| 259 | type: "network", |
| 260 | status: 0, |
| 261 | code: "WEBHOOK_SIGNATURE_INVALID", |
| 262 | }); |
| 263 | } |
| 264 |
| 265 | const parsed = JSON.parse(rawBody) as Record<string, unknown>; |
| 266 |
| 267 | return { |
| 268 | type: (parsed["type"] as string) ?? "unknown", |
| 269 | deliveryId: deliveryId ?? "", |
| 270 | timestamp, |
| 271 | workspaceId: (parsed["workspaceId"] as string) ?? "", |
| 272 | data: (parsed["data"] as Record<string, unknown>) ?? {}, |
| 273 | } as WebhookEvent; |
| 274 | }, |
| 275 |
| 276 | /** |
| 277 | * Verify a webhook signature without parsing the body. |
| 278 | * Returns `true` if valid, `false` otherwise. Does not throw. |
| 279 | */ |
| 280 | async verify( |
| 281 | rawBody: string, |
| 282 | headers: Headers | Record<string, string | undefined>, |
| 283 | secret: string, |
| 284 | ): Promise<boolean> { |
| 285 | const getHeader = (name: string): string | undefined => { |
| 286 | if (headers instanceof Headers) { |
| 287 | return headers.get(name) ?? undefined; |
| 288 | } |
| 289 | return headers[name]; |
| 290 | }; |
| 291 |
| 292 | const signature = getHeader(COLINE_SIGNATURE_HEADER); |
| 293 | const timestamp = getHeader(COLINE_TIMESTAMP_HEADER); |
| 294 |
| 295 | if (!signature || !timestamp) return false; |
| 296 |
| 297 | const timestampMs = new Date(timestamp).getTime(); |
| 298 | if ( |
| 299 | Number.isNaN(timestampMs) || |
| 300 | Math.abs(Date.now() - timestampMs) > MAX_TIMESTAMP_DRIFT_MS |
| 301 | ) { |
| 302 | return false; |
| 303 | } |
| 304 |
| 305 | return verifyAppRequestSignature({ |
| 306 | secret, |
| 307 | timestamp, |
| 308 | body: rawBody, |
| 309 | signature, |
| 310 | }); |
| 311 | }, |
| 312 | }; |
| 313 |
