chore: import upstream snapshot with attribution

apps/sim/lib/webhooks/providers/resend.ts

@@ -0,0 +1,299 @@
+import { createLogger } from '@sim/logger'
+import { safeCompare } from '@sim/security/compare'
+import { hmacSha256Base64 } from '@sim/security/hmac'
+import { NextResponse } from 'next/server'
+import { getNotificationUrl, getProviderConfig } from '@/lib/webhooks/provider-subscription-utils'
+import type {
+  AuthContext,
+  DeleteSubscriptionContext,
+  EventMatchContext,
+  FormatInputContext,
+  FormatInputResult,
+  SubscriptionContext,
+  SubscriptionResult,
+  WebhookProviderHandler,
+} from '@/lib/webhooks/providers/types'
+import {
+  RESEND_ALL_WEBHOOK_EVENT_TYPES,
+  RESEND_TRIGGER_TO_EVENT_TYPE,
+} from '@/triggers/resend/utils'
+
+const logger = createLogger('WebhookProvider:Resend')
+
+/**
+ * Verify a Resend webhook signature using the Svix signing scheme.
+ * Resend uses Svix under the hood: HMAC-SHA256 of `${svix-id}.${svix-timestamp}.${body}`
+ * signed with the base64-decoded `whsec_...` secret.
+ */
+function verifySvixSignature(
+  secret: string,
+  msgId: string,
+  timestamp: string,
+  signatures: string,
+  rawBody: string
+): boolean {
+  try {
+    const ts = Number.parseInt(timestamp, 10)
+    const now = Math.floor(Date.now() / 1000)
+    if (Number.isNaN(ts) || Math.abs(now - ts) > 5 * 60) {
+      return false
+    }
+
+    const secretBytes = Buffer.from(secret.replace(/^whsec_/, ''), 'base64')
+    const toSign = `${msgId}.${timestamp}.${rawBody}`
+    const expectedSignature = hmacSha256Base64(toSign, secretBytes)
+
+    const providedSignatures = signatures.split(' ')
+    for (const versionedSig of providedSignatures) {
+      const parts = versionedSig.split(',')
+      if (parts.length !== 2) continue
+      const sig = parts[1]
+      if (safeCompare(sig, expectedSignature)) {
+        return true
+      }
+    }
+    return false
+  } catch (error) {
+    logger.error('Error verifying Resend Svix signature:', error)
+    return false
+  }
+}
+
+export const resendHandler: WebhookProviderHandler = {
+  async verifyAuth({
+    request,
+    rawBody,
+    requestId,
+    providerConfig,
+  }: AuthContext): Promise<NextResponse | null> {
+    const signingSecret = providerConfig.signingSecret as string | undefined
+    if (!signingSecret?.trim()) {
+      logger.warn(`[${requestId}] Resend webhook missing signing secret in provider configuration`)
+      return new NextResponse('Unauthorized - Resend signing secret is required', { status: 401 })
+    }
+
+    const svixId = request.headers.get('svix-id')
+    const svixTimestamp = request.headers.get('svix-timestamp')
+    const svixSignature = request.headers.get('svix-signature')
+
+    if (!svixId || !svixTimestamp || !svixSignature) {
+      logger.warn(`[${requestId}] Resend webhook missing Svix signature headers`)
+      return new NextResponse('Unauthorized - Missing Resend signature headers', { status: 401 })
+    }
+
+    if (!verifySvixSignature(signingSecret, svixId, svixTimestamp, svixSignature, rawBody)) {
+      logger.warn(`[${requestId}] Resend Svix signature verification failed`)
+      return new NextResponse('Unauthorized - Invalid Resend signature', { status: 401 })
+    }
+
+    return null
+  },
+
+  matchEvent({ body, providerConfig, requestId }: EventMatchContext): boolean {
+    const triggerId = providerConfig.triggerId as string | undefined
+    if (!triggerId || triggerId === 'resend_webhook') {
+      return true
+    }
+
+    const expectedType = RESEND_TRIGGER_TO_EVENT_TYPE[triggerId]
+    if (!expectedType) {
+      logger.debug(`[${requestId}] Unknown Resend triggerId ${triggerId}, skipping.`)
+      return false
+    }
+
+    const actualType = (body as Record<string, unknown>)?.type as string | undefined
+
+    if (actualType !== expectedType) {
+      logger.debug(
+        `[${requestId}] Resend event type mismatch: expected ${expectedType}, got ${actualType}. Skipping.`
+      )
+      return false
+    }
+
+    return true
+  },
+
+  async formatInput({ body }: FormatInputContext): Promise<FormatInputResult> {
+    const payload = body as Record<string, unknown>
+    const data = payload.data as Record<string, unknown> | undefined
+    const bounce = data?.bounce as Record<string, unknown> | undefined
+    const click = data?.click as Record<string, unknown> | undefined
+    const dataCreatedAt = data?.created_at
+    const dataCreatedAtStr =
+      typeof dataCreatedAt === 'string'
+        ? dataCreatedAt
+        : dataCreatedAt != null
+          ? String(dataCreatedAt)
+          : null
+
+    return {
+      input: {
+        type: payload.type,
+        created_at: payload.created_at,
+        data_created_at: dataCreatedAtStr,
+        data: data ?? null,
+        email_id: data?.email_id ?? null,
+        broadcast_id: data?.broadcast_id ?? null,
+        template_id: data?.template_id ?? null,
+        tags: data?.tags ?? null,
+        from: data?.from ?? null,
+        to: data?.to ?? null,
+        subject: data?.subject ?? null,
+        bounceType: bounce?.type ?? null,
+        bounceSubType: bounce?.subType ?? null,
+        bounceMessage: bounce?.message ?? null,
+        clickIpAddress: click?.ipAddress ?? null,
+        clickLink: click?.link ?? null,
+        clickTimestamp: click?.timestamp ?? null,
+        clickUserAgent: click?.userAgent ?? null,
+      },
+    }
+  },
+
+  async createSubscription(ctx: SubscriptionContext): Promise<SubscriptionResult | undefined> {
+    const { webhook, requestId } = ctx
+    try {
+      const providerConfig = getProviderConfig(webhook)
+      const apiKey = providerConfig.apiKey as string | undefined
+      const triggerId = providerConfig.triggerId as string | undefined
+
+      if (!apiKey) {
+        logger.warn(`[${requestId}] Missing apiKey for Resend webhook creation.`, {
+          webhookId: webhook.id,
+        })
+        throw new Error(
+          'Resend API Key is required. Please provide your Resend API Key in the trigger configuration.'
+        )
+      }
+
+      const events =
+        triggerId === 'resend_webhook'
+          ? RESEND_ALL_WEBHOOK_EVENT_TYPES
+          : triggerId && RESEND_TRIGGER_TO_EVENT_TYPE[triggerId]
+            ? [RESEND_TRIGGER_TO_EVENT_TYPE[triggerId]]
+            : null
+
+      if (!events?.length) {
+        throw new Error(`Unknown or unsupported Resend trigger type: ${triggerId ?? '(missing)'}`)
+      }
+
+      const notificationUrl = getNotificationUrl(webhook)
+
+      logger.info(`[${requestId}] Creating Resend webhook`, {
+        triggerId,
+        events,
+        webhookId: webhook.id,
+      })
+
+      const resendResponse = await fetch('https://api.resend.com/webhooks', {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${apiKey}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          endpoint: notificationUrl,
+          events,
+        }),
+      })
+
+      const responseBody = (await resendResponse.json()) as Record<string, unknown>
+
+      if (!resendResponse.ok) {
+        const errorMessage =
+          (responseBody.message as string) ||
+          (responseBody.name as string) ||
+          'Unknown Resend API error'
+        logger.error(
+          `[${requestId}] Failed to create webhook in Resend for webhook ${webhook.id}. Status: ${resendResponse.status}`,
+          { message: errorMessage, response: responseBody }
+        )
+
+        let userFriendlyMessage = 'Failed to create webhook subscription in Resend'
+        if (resendResponse.status === 401 || resendResponse.status === 403) {
+          userFriendlyMessage = 'Invalid Resend API Key. Please verify your API Key is correct.'
+        } else if (errorMessage && errorMessage !== 'Unknown Resend API error') {
+          userFriendlyMessage = `Resend error: ${errorMessage}`
+        }
+
+        throw new Error(userFriendlyMessage)
+      }
+
+      const externalId = responseBody.id
+      const signingSecretOut = responseBody.signing_secret
+
+      if (typeof externalId !== 'string' || !externalId.trim()) {
+        throw new Error(
+          'Resend webhook was created but the API response did not include a webhook id.'
+        )
+      }
+      if (typeof signingSecretOut !== 'string' || !signingSecretOut.trim()) {
+        throw new Error(
+          'Resend webhook was created but the API response did not include a signing secret.'
+        )
+      }
+
+      logger.info(
+        `[${requestId}] Successfully created webhook in Resend for webhook ${webhook.id}.`,
+        {
+          resendWebhookId: externalId,
+        }
+      )
+
+      return {
+        providerConfigUpdates: {
+          externalId,
+          signingSecret: signingSecretOut,
+        },
+      }
+    } catch (error: unknown) {
+      const err = error as Error
+      logger.error(
+        `[${requestId}] Exception during Resend webhook creation for webhook ${webhook.id}.`,
+        {
+          message: err.message,
+          stack: err.stack,
+        }
+      )
+      throw error
+    }
+  },
+
+  async deleteSubscription(ctx: DeleteSubscriptionContext): Promise<void> {
+    const { webhook, requestId } = ctx
+    try {
+      const config = getProviderConfig(webhook)
+      const apiKey = config.apiKey as string | undefined
+      const externalId = config.externalId as string | undefined
+
+      if (!apiKey || !externalId) {
+        logger.warn(
+          `[${requestId}] Missing apiKey or externalId for Resend webhook deletion ${webhook.id}, skipping cleanup`
+        )
+        if (ctx.strict) throw new Error('Missing Resend webhook deletion credentials')
+        return
+      }
+
+      const resendResponse = await fetch(`https://api.resend.com/webhooks/${externalId}`, {
+        method: 'DELETE',
+        headers: {
+          Authorization: `Bearer ${apiKey}`,
+        },
+      })
+
+      if (!resendResponse.ok && resendResponse.status !== 404) {
+        const responseBody = await resendResponse.json().catch(() => ({}))
+        logger.warn(
+          `[${requestId}] Failed to delete Resend webhook (non-fatal): ${resendResponse.status}`,
+          { response: responseBody }
+        )
+        if (ctx.strict) throw new Error(`Failed to delete Resend webhook: ${resendResponse.status}`)
+      } else {
+        logger.info(`[${requestId}] Successfully deleted Resend webhook ${externalId}`)
+      }
+    } catch (error) {
+      logger.warn(`[${requestId}] Error deleting Resend webhook (non-fatal)`, error)
+      if (ctx.strict) throw error
+    }
+  },
+}