Correct Hooks가 비대칭 서명으로 웹훅 인증을 간편하게 한다

npm i @handlewithcare/correct-hooks 

pip install correct_hooks 

cargo add correct_hooks 

import { generateSecretSigningKey } from "@handlewithcare/correct-hooks";

const secretSigningKey = generateSecretSigningKey();
const secretSigningKeyJson = JSON.stringify(secretSigningKey);

import { createPublicVerifyingKeySet } from "@handlewithcare/correct-hooks";

const publicVerifyingKeySet = createPublicVerifyingKeySet([secretSigningKey]);
const publicVerifyingKeySetJson = JSON.stringify(publicVerifyingKeySet);

from correct_hooks import generate_secret_signing_key

secret_signing_key = generate_secret_signing_key()
secret_signing_key_json = secret_signing_key.model_dump_json()

from correct_hooks import create_public_verifying_key_set

public_verifying_key_set = create_public_verifying_key_set([secret_signing_key])
public_verifying_key_set_json = public_verifying_key_set.model_dump_json()

use correct_hooks::generate_secret_signing_key;

let secret_signing_key = generate_secret_signing_key();
let secret_signing_key_json = serde_json::to_string(&secret_signing_key).unwrap();

use correct_hooks::create_public_verifying_key_set;

let public_verifying_key_set = create_public_verifying_key_set(&vec![secret_signing_key]).unwrap();
let public_verifying_key_set_json = serde_json::to_string(&public_verifying_key_set);

import { sign } from "@handlewithcare/correct-hooks";

const signatureHeaders = sign({
 webhookId,
 recipientId,
 targetUrl,
 method,
 requestBody,
 secretSigningKey,
});
const { correctHooksSignatureComponents, correctHooksSignature } = signatureHeaders;

import { Verifier } from "@handlewithcare/correct-hooks";

const verifier = new Verifier({
 recipientId,
 publicVerifyingKeySetUrl,
});

let verifiedData;
try {
 verifiedData = await verifier.verify({
 targetUrl,
 method,
 correctHooksSignatureComponents,
 correctHooksSignature,
 requestBody,
 });
} catch {
 return StatusCode.FORBIDDEN;
}
const { webhookId } = verifiedData 

from correct_hooks import (sign, SignArgs)

signature_headers = sign(SignArgs(
 webhook_id=webhook_id,
 recipient_id=recipient_id,
 target_url=target_url,
 method=method,
 request_body=request_body,
 secret_signing_key=secret_signing_key,
))
correct_hooks_signature_components = signature_headers.correct_hooks_signature_components
correct_hooks_signature = signature_headers.correct_hooks_signature

from correct_hooks import (Verifier, VerifierConfig)

verifier = Verifier(VerifierConfig(
 recipient_id=recipient_id,
 public_verifying_key_set_url=AnyUrl(public_verifying_key_set_url),
))

from correct_hooks import VerifyArgs

try:
 verified_data = await verifier.verify(
 target_url=target_url,
 method=method,
 correct_hooks_signature_components=signature_headers.correct_hooks_signature_components,
 correct_hooks_signature=signature_headers.correct_hooks_signature,
 request_body=request_body,
 )
except Exception:
 return HTTPStatus.FORBIDDEN

use correct_hooks::{SignArgs, sign};

let signature_headers = sign(
 SignArgs {
 webhook_id,
 recipient_id,
 target_url,
 method,
 request_body, 
 secret_signing_key,
 }
).unwrap();
let correct_hooks_signature_components = &signature_headers.correct_hooks_signature_components;
let correct_hooks_signature = &signature_headers.correct_hooks_signature;

use correct_hooks::{Verifier, VerifierConfig};

let verifier = Verifier::new(
 VerifierConfig {
 recipient_id,
 public_verifying_key_set_url,
 signature_ttl_seconds: None,
 public_verifying_key_set_ttl_seconds: None,
 }
);

use correct_hooks::VerifyArgs;

let verify_result = verifier.verify(VerifyArgs{
 target_url,
 method,
 correct_hooks_signature_components,
 correct_hooks_signature,
 request_body,
}).await;

if verify_result.is_err() {
 return StatusCode::FORBIDDEN;
}
let verified_data = verify_result.unwrap();