Merge pull request #1318 from victoreduardo/victoreduardos/jwt-webhook

Tornando Webhook mais seguro com JWT token

Author: DavidsonGomes

package-lock.json

@@ -75,6 +75,7 @@
     "jimp": "^0.16.13",
     "json-schema": "^0.4.0",
     "jsonschema": "^1.4.1",
+    "jsonwebtoken": "^9.0.2",
     "link-preview-js": "^3.0.13",
     "long": "^5.2.3",
     "mediainfo.js": "^0.3.4",

package.json

@@ -6,6 +6,7 @@ import { configService, Log, Webhook } from '@config/env.config';
 import { Logger } from '@config/logger.config';
 import { BadRequestException } from '@exceptions';
 import axios, { AxiosInstance } from 'axios';
+import * as jwt from 'jsonwebtoken';
 
 import { EmitData, EventController, EventControllerInterface } from '../event.controller';
 
@@ -73,7 +74,16 @@ export class WebhookController extends EventController implements EventControlle
 
     const webhookConfig = configService.get<Webhook>('WEBHOOK');
     const webhookLocal = instance?.events;
-    const webhookHeaders = instance?.headers;
+    const webhookHeaders = { ...((instance?.headers as Record<string, string>) || {}) };
+
+    if (webhookHeaders && 'jwt_key' in webhookHeaders) {
+      const jwtKey = webhookHeaders['jwt_key'];
+      const jwtToken = this.generateJwtToken(jwtKey);
+      webhookHeaders['Authorization'] = `Bearer ${jwtToken}`;
+
+      delete webhookHeaders['jwt_key'];
+    }
+
     const we = event.replace(/[.-]/gm, '_').toUpperCase();
     const transformedWe = we.replace(/_/gm, '-').toLowerCase();
     const enabledLog = configService.get<Log>('LOG').LEVEL.includes('WEBHOOKS');
@@ -230,4 +240,24 @@ export class WebhookController extends EventController implements EventControlle
       }
     }
   }
+
+  private generateJwtToken(authToken: string): string {
+    try {
+      const payload = {
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor(Date.now() / 1000) + 600, // 10 min expiration
+        app: 'evolution',
+        action: 'webhook',
+      };
+
+      const token = jwt.sign(payload, authToken, { algorithm: 'HS256' });
+      return token;
+    } catch (error) {
+      this.logger.error({
+        local: 'WebhookController.generateJwtToken',
+        message: `JWT generation failed: ${error?.message}`,
+      });
+      throw error;
+    }
+  }
 }