wip

Author: Ashutosh-Bhadauriya

client/client.go

@@ -28,7 +28,7 @@ func (c Client) defaultHeaders() http.Header {
 	return http.Header{
 		"Accept":       {"*/*"},
 		"Content-Type": {"application/json"},
-		"User-Agent":   {"authsignalgo/v2"},
+		"User-Agent":   {"authsignalgo/v1"},
 	}
 }
 

client/webhook_test.go

@@ -16,7 +16,6 @@ func getTestWebhook() *Webhook {
 	return NewWebhook(testSecretKey)
 }
 
-// generateTestSignature creates a valid signature for testing purposes
 func generateTestSignature(payload string, timestamp int64, secret string) string {
 	hmacContent := fmt.Sprintf("%d.%s", timestamp, payload)
 	mac := hmac.New(sha256.New, []byte(secret))
@@ -99,13 +98,10 @@ func TestInvalidComputedSignature(t *testing.T) {
 func TestValidSignature(t *testing.T) {
 	webhook := getTestWebhook()
 
-	// Payload should be compact JSON (no whitespace)
 	payload := `{"version":1,"id":"bc1598bc-e5d6-4c69-9afb-1a6fe3469d6e","source":"https://authsignal.com","time":"2025-02-20T01:51:56.070Z","tenantId":"7752d28e-e627-4b1b-bb81-b45d68d617bc","type":"email.created","data":{"to":"chris@authsignal.com","code":"157743","userId":"b9f74d36-fcfc-4efc-87f1-3664ab5a7fb0","actionCode":"accountRecovery","idempotencyKey":"ba8c1a7c-775d-4dff-9abe-be798b7b8bb9","verificationMethod":"EMAIL_OTP"}}`
 
-	// Ignore tolerance window by passing -1
 	tolerance := -1
 
-	// Generate a valid signature dynamically
 	timestamp := time.Now().Unix()
 	signature := generateTestSignature(payload, timestamp, testSecretKey)
 
@@ -141,13 +137,10 @@ func TestValidSignatureWhenTwoApiKeysActive(t *testing.T) {
 
 	payload := `{"version":1,"id":"af7be03c-ea8f-4739-b18e-8b48fcbe4e38","source":"https://authsignal.com","time":"2025-02-20T01:47:17.248Z","tenantId":"7752d28e-e627-4b1b-bb81-b45d68d617bc","type":"email.created","data":{"to":"chris@authsignal.com","code":"718190","userId":"b9f74d36-fcfc-4efc-87f1-3664ab5a7fb0","actionCode":"accountRecovery","idempotencyKey":"68d68190-fac9-4e91-b277-c63d31d3c6b1","verificationMethod":"EMAIL_OTP"}}`
 
-	// Ignore tolerance window
 	tolerance := -1
 
-	// Generate a valid signature and add an old/invalid signature to simulate two API keys
 	timestamp := time.Now().Unix()
 	validSignature := generateTestSignature(payload, timestamp, testSecretKey)
-	// Add an invalid signature from an "old" key
 	signature := validSignature + ",v2=oldKeyInvalidSignature123"
 
 	event, err := webhook.ConstructEvent(payload, signature, tolerance)
@@ -163,7 +156,6 @@ func TestValidSignatureWhenTwoApiKeysActive(t *testing.T) {
 }
 
 func TestValidSignatureWithOldKeyFirst(t *testing.T) {
-	// Test that validation works when the valid signature is NOT the first one
 	webhook := getTestWebhook()
 
 	payload := `{"version":1,"id":"test-id","source":"https://authsignal.com","time":"2025-02-20T01:47:17.248Z","tenantId":"test-tenant","type":"email.created","data":{}}`
@@ -176,7 +168,6 @@ func TestValidSignatureWithOldKeyFirst(t *testing.T) {
 	mac.Write([]byte(hmacContent))
 	validSig := strings.ReplaceAll(base64.StdEncoding.EncodeToString(mac.Sum(nil)), "=", "")
 
-	// Put the invalid signature FIRST, valid signature SECOND
 	signature := fmt.Sprintf("t=%d,v2=invalidOldKeySignature,v2=%s", timestamp, validSig)
 
 	event, err := webhook.ConstructEvent(payload, signature, tolerance)
@@ -219,7 +210,6 @@ func TestConstructEventWithDefaultTolerance(t *testing.T) {
 	payload := "{}"
 	signature := "t=1630000000,v2=invalid_signature"
 
-	// This should fail due to timestamp being outside tolerance
 	_, err := webhook.ConstructEventWithDefaultTolerance(payload, signature)
 
 	if err == nil {
@@ -242,7 +232,6 @@ func TestConstructEventWithDefaultToleranceValid(t *testing.T) {
 	webhook := getTestWebhook()
 	payload := `{"version":1,"type":"test.event","id":"123","source":"test","time":"2025-01-01T00:00:00Z","tenantId":"tenant","data":{}}`
 
-	// Generate a signature with current timestamp (within tolerance)
 	timestamp := time.Now().Unix()
 	signature := generateTestSignature(payload, timestamp, testSecretKey)
 
@@ -266,7 +255,6 @@ func TestConstructEventWithDefaultToleranceValid(t *testing.T) {
 func TestMissingTimestamp(t *testing.T) {
 	webhook := getTestWebhook()
 	payload := "{}"
-	// Signature without timestamp
 	signature := "v2=someSignature"
 
 	_, err := webhook.ConstructEvent(payload, signature, DefaultTolerance)
@@ -290,7 +278,6 @@ func TestMissingTimestamp(t *testing.T) {
 func TestMissingSignature(t *testing.T) {
 	webhook := getTestWebhook()
 	payload := "{}"
-	// Signature with timestamp but no v2 signature
 	signature := "t=1234567890"
 
 	_, err := webhook.ConstructEvent(payload, signature, DefaultTolerance)
@@ -313,7 +300,6 @@ func TestMissingSignature(t *testing.T) {
 
 func TestInvalidJSON(t *testing.T) {
 	webhook := getTestWebhook()
-	// Invalid JSON payload
 	payload := "not valid json"
 
 	timestamp := time.Now().Unix()
@@ -326,7 +312,6 @@ func TestInvalidJSON(t *testing.T) {
 		return
 	}
 
-	// Should be a JSON unmarshal error, not InvalidSignatureError
 	_, ok := err.(*InvalidSignatureError)
 	if ok {
 		t.Error("Expected JSON error, not InvalidSignatureError")
@@ -337,11 +322,9 @@ func TestTimestampAtExactTolerance(t *testing.T) {
 	webhook := getTestWebhook()
 	payload := `{"version":1,"type":"test","id":"1","source":"test","time":"2025-01-01T00:00:00Z","tenantId":"t","data":{}}`
 
-	// Timestamp exactly at the tolerance boundary (5 minutes ago)
 	timestamp := time.Now().Unix() - (DefaultTolerance * 60)
 	signature := generateTestSignature(payload, timestamp, testSecretKey)
 
-	// Should still be valid (boundary is inclusive)
 	event, err := webhook.ConstructEvent(payload, signature, DefaultTolerance)
 
 	if err != nil {
@@ -358,7 +341,6 @@ func TestTimestampJustOutsideTolerance(t *testing.T) {
 	webhook := getTestWebhook()
 	payload := "{}"
 
-	// Timestamp just outside the tolerance (5 minutes + 1 second ago)
 	timestamp := time.Now().Unix() - (DefaultTolerance*60 + 1)
 	signature := generateTestSignature(payload, timestamp, testSecretKey)
 
@@ -384,11 +366,9 @@ func TestZeroTolerance(t *testing.T) {
 	webhook := getTestWebhook()
 	payload := `{"version":1,"type":"test","id":"1","source":"test","time":"2025-01-01T00:00:00Z","tenantId":"t","data":{}}`
 
-	// Old timestamp
 	timestamp := int64(1630000000)
 	signature := generateTestSignature(payload, timestamp, testSecretKey)
 
-	// With tolerance=0, timestamp check should be skipped (like tolerance=-1)
 	event, err := webhook.ConstructEvent(payload, signature, 0)
 
 	if err != nil {
@@ -402,7 +382,6 @@ func TestZeroTolerance(t *testing.T) {
 }
 
 func TestSignatureWithEqualsInValue(t *testing.T) {
-	// Test that signatures containing '=' in the value part are parsed correctly
 	webhook := getTestWebhook()
 	payload := `{"version":1,"type":"test","id":"1","source":"test","time":"2025-01-01T00:00:00Z","tenantId":"t","data":{}}`