Expose array of secrets option at toplevel

Add typechecking and integration tests

FIXES octokit#770

src/index.ts

@@ -43,12 +43,12 @@ class Webhooks<TTransformed = unknown> {
       | EmitterWebhookEventWithSignature
   ) => Promise<void>;
 
-  constructor(options: Options<TTransformed> & { secret: string }) {
+  constructor(options: Options<TTransformed> & { secret: string | string[] }) {
     if (!options || !options.secret) {
       throw new Error("[@octokit/webhooks] options.secret required");
     }
 
-    const state: State & { secret: string } = {
+    const state: State & { secret: string | string[] } = {
       eventHandler: createEventHandler(options),
       secret: options.secret,
       hooks: {},

src/types.ts

@@ -33,7 +33,7 @@ interface BaseWebhookEvent<TName extends WebhookEventName> {
 }
 
 export interface Options<TTransformed = unknown> {
-  secret?: string;
+  secret?: string | string[];
   transform?: TransformMethod<TTransformed>;
   log?: Partial<Logger>;
 }

test/integration/webhooks.test.ts

@@ -81,6 +81,22 @@ describe("Webhooks", () => {
     });
   });
 
+  test("webhooks.verifyAndReceive({ ...event, signature }) with one of several secrets", async () => {
+    const secret1 = "mysecret";
+    const secret2 = "mysecret2";
+    const webhooks = new Webhooks({ secret: [secret1, secret2] });
+
+    await webhooks.verifyAndReceive({
+      id: "1",
+      name: "push",
+      payload: pushEventPayloadString,
+      signature: await sign(
+        { secret: secret2, algorithm: "sha256" },
+        pushEventPayloadString
+      ),
+    });
+  });
+
   test("webhooks.verifyAndReceive(event) with incorrect signature", async () => {
     const webhooks = new Webhooks({ secret: "mysecret" });
 

test/typescript-validate.ts

@@ -69,6 +69,11 @@ export default async function () {
     secret: "blah",
   });
 
+  // Check that secret can be an array, too
+  new Webhooks({
+    secret: ["blah", "bleh"],
+  });
+
   // Check all supported options
   const webhooks = new Webhooks({
     secret: "blah",