Repository navigation
Webhooks: verify with @base44/platform/server - #74
Merged
Merged
Conversation
✅ Deploy Preview for sunny44-builder ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for base44-platform-starter ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
ozsay
force-pushed
the
webhooks-platform-sdk
branch
from
October 18, 2026 13:12
01b74f9 to
796f66a
Compare
ozsay
changed the title
ozsay
force-pushed
the
webhooks-platform-sdk
branch
from
October 19, 2026 09:11
796f66a to
a95cd57
Compare
…d verifier The receiver mounts the SDK's createHandler, which reads the raw body, verifies the v1a signature against BASE44_WEBHOOK_PUBLIC_KEYS, answers the activation probe and picks the status code (204 / 400 / 500). src/lib/base44Webhooks.ts builds the client and the per-call keys, and replaces base44WebhookSignature.ts. Uses the released @base44/platform 0.3.0. Its createPlatformServer() takes no options, so the receiver needs only BASE44_WEBHOOK_PUBLIC_KEYS. webhook:smoke now drives the SDK, keeps every negative control, and adds the handler's status codes and the challenge echo. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
ozsay
force-pushed
the
webhooks-platform-sdk
branch
from
October 19, 2026 09:12
a95cd57 to
6f79a47
Compare
amitbardos
added a commit
that referenced
this pull request
Oct 19, 2026
main's webhook receiver (#74) depends on @base44/platform too; both it and the example now take ^0.4.0, so the lockfile resolves one copy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
src/lib/base44WebhookSignature.ts) with the webhooks module of the released@base44/platform0.3.0 (base44/javascript-sdk#319)./api/base44/webhooksnow mountswebhooks.createHandler. The SDK reads the raw body, verifies, echoes thewebhook.test.v1challenge and picks the status: 204, 400 on a failed verification, 500 on bad keys or a throwing handler. The only shell logic left isapp.deleted.v1→removePins(event.data.app_id), now typed by the SDK's event map.src/lib/base44Webhooks.tsbuilds the client withcreatePlatformServer()and readsBASE44_WEBHOOK_PUBLIC_KEYSper call, so a rotated key deploys without a code change.webhook:smokedrives the SDK and keeps every negative control. It also adds handler checks: 204 for a genuine delivery, 400 for a tampered one, and the challenge echo.docs/base44-webhooks.md,.env.example.Behaviour changes
204instead of200 {"ok":true}, and a rejected one gets{"error":"<code>"}instead of{"error":"invalid_signature"}.BASE44_WEBHOOK_PUBLIC_KEYS. The SDK's server client no longer takes an API key or host.netlify.tomlfiles (the root andexamples/white-label-minimal/) now leaveexamples/white-label-minimal/node_modules/**out of the secrets scan. The minimal example still pins@base44/platform@^0.1.0, which 0.3.0 at the root no longer satisfies, so npm installs 0.1.0 inside the example, and the scan matched a preview env value in that package's README and types. Installed packages are never deployed. Moving the example to 0.3.0 needs a client migration (Base44PlatformClientis gone), so it's left for a separate PR.Test plan
npm run webhook:smoke: all 16 checks pass against@base44/platform@0.3.0npm run lintnpm run typecheck: no errors insrc/orscripts/(the only error is the stale.nextLayoutPropstype)app.*events, signed and verified by an independent receiver (outside this repo)🤖 Generated with Claude Code