components/aftership/sources/common/webhook.mjs (4)

25-42: Minor: redundant slice and inconsistent timestamp units.

• slice(0, 25) is redundant with limit: 25.
• ts here uses seconds, while generateMeta returns milliseconds. Prefer consistency (ms in meta is standard; consider removing ts from payload or making both ms).

-      trackings
-        .slice(0, 25)
+      trackings
         .reverse()
         .forEach((tracking) => {
           this.processResource({
             event: this.getEventName(),
             event_id: tracking.id,
             msg: tracking,
-            ts: Date.parse(tracking.updated_at) / 1000,
+            // Consider removing or making ms to match meta.ts
+            ts: Math.floor(Date.parse(tracking.updated_at) / 1000),
           });
         });

---

20-23: Nit: message says “skipping deployment” but code throws.

Either skip without throwing, or adjust the message to reflect a hard failure.

-        console.log("No webhook secret was provided, skipping deployment");
-        throw new ConfigurationError("No webhook secret was provided, skipping deployment");
+        const msg = "A webhook secret is required to deploy this source";
+        console.log(msg);
+        throw new ConfigurationError(msg);

---

52-62: Optional: timing-safe compare for HMAC.

Use crypto.timingSafeEqual to avoid subtle timing leaks on signature mismatch.

-      const hash = createHmac("sha256", webhookSecret)
-        .update(bodyRaw)
-        .digest("base64");
-      return hash === signature;
+      const digest = createHmac("sha256", webhookSecret).update(bodyRaw).digest("base64");
+      if (!signature) return false;
+      const a = Buffer.from(digest);
+      const b = Buffer.from(signature);
+      return a.length === b.length && crypto.timingSafeEqual(a, b);

---

5-17: Consider documenting how to obtain the webhook secret.

Good description; add a short note that deployment will fail without it (align with hook behavior).

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro