v2.0.0-alpha.2

Second alpha of the 2.x line. Still not production-ready — the API may change before the stable 2.0.0.

Changes since v2.0.0-alpha.1:

Added

• Incoming webhook parsing & verification (#6). A new standalone WebhookParser (implementing WebhookParserInterface) verifies the webhooks Shipmondo POSTs to your server and hands back a typed WebhookEvent:
  • Verifies the HS256 signature of the {"data":"<JWT>"} body with the webhook key — the only proof a request genuinely came from Shipmondo — and pins HS256 so alg:none / algorithm-confusion tokens are rejected.
  • parse(ServerRequestInterface $request, string $key) for PSR-7, or parsePayload(string $body, array $headers, string $key) for any other framework.
  • Exposes the five SMD-* metadata headers (action, resource type, resource id, webhook id, user) plus the decoded resource data.
  • New exception branch off ShipmondoException: WebhookException → WebhookVerificationException (forged / wrong key → 401/403) and MalformedWebhookException (bad body / non-HS256 token → 400).
  • Webhook keys must be ≥32 bytes (HS256 requirement, RFC 7518) — enforced both when creating a webhook (WebhookRequest::$key) and when verifying one.
  • See the new “Receiving webhooks” section in the README.

Maintenance

• Fixed Codecov uploads — replaced the long-sunset codecov.io/bash uploader with codecov/codecov-action@v5, so coverage is reported again (#7).
• Raised test coverage from 84% → 97% lines (Client now fully covered) (#8).

Dependencies

• Added firebase/php-jwt: ^7.0 (used by WebhookParser for HS256 verification).

Upgrading from 1.x

See UPGRADE.md for the complete migration guide covering every breaking change.

Full Changelog: v2.0.0-alpha.1...2.x