SDK: Add verify parameter in Bridge.Webhook.parse function #8395
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🦋 Changeset detectedLatest commit: a54c1ab The changes in this PR will be included in the next version bump. This PR includes changesets to release 4 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
WalkthroughAdds an optional Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant Webhook as Bridge.Webhook.parse()
participant Validator as Verify Logic
Client->>Webhook: parse(payload, headers, secret, tolerance, verify?)
activate Webhook
Webhook->>Webhook: Validate timestamp & signature
alt signature valid
Webhook->>Webhook: Parse JSON payload
alt verify parameter provided
activate Validator
Validator->>Validator: Compare receiverAddress (case-insensitive)
Validator->>Validator: Compare destinationTokenAddress (onchain/onramp)
Validator->>Validator: Compare destinationChainId (onchain/onramp)
Validator->>Validator: Compare minDestinationAmount vs destination amount
alt all checks pass
Validator-->>Webhook: validation passed
else any check fails
Validator-->>Webhook: throw descriptive validation error
end
deactivate Validator
end
Webhook-->>Client: return WebhookPayload
else signature invalid
Webhook-->>Client: throw verification error
end
deactivate Webhook
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes
Pre-merge checks and finishing touches❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro Disabled knowledge base sources:
📒 Files selected for processing (3)
🧰 Additional context used📓 Path-based instructions (5)**/*.{ts,tsx}📄 CodeRabbit inference engine (CLAUDE.md)
Files:
**/*.{ts,tsx,js,jsx}📄 CodeRabbit inference engine (CLAUDE.md)
Files:
packages/thirdweb/**/*.{ts,tsx}📄 CodeRabbit inference engine (AGENTS.md)
Files:
**/*.test.{ts,tsx}📄 CodeRabbit inference engine (CLAUDE.md)
Files:
.changeset/*.md📄 CodeRabbit inference engine (AGENTS.md)
Files:
🧠 Learnings (6)📚 Learning: 2025-06-26T19:46:04.024ZApplied to files:
📚 Learning: 2025-07-18T19:19:55.613ZApplied to files:
📚 Learning: 2025-08-29T15:37:38.513ZApplied to files:
📚 Learning: 2025-08-29T15:37:38.513ZApplied to files:
📚 Learning: 2025-07-18T19:19:55.613ZApplied to files:
📚 Learning: 2025-08-29T15:37:38.513ZApplied to files:
🧬 Code graph analysis (1)packages/thirdweb/src/bridge/Webhook.test.ts (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
🔇 Additional comments (3)
Warning Review ran into problems🔥 ProblemsErrors were encountered while retrieving linked issues. Errors (1)
Comment |
How to use the Graphite Merge QueueAdd either label to this PR to merge it via the merge queue:
You must have a Graphite account in order to use the merge queue. Sign up using this link. An organization admin has enabled the Graphite Merge Queue in this repository. Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue. This stack of pull requests is managed by Graphite. Learn more about stacking. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
packages/thirdweb/src/bridge/Webhook.test.ts (1)
649-695: Consider testing case-insensitive address matching.The implementation uses
.toLowerCase()for address comparison (lines 212-213, 226-227 in Webhook.ts), but the tests don't verify this behavior. Consider adding a test case where the verify address has different casing than the payload address to ensure case-insensitive matching works correctly.Example test:
it("should pass when receiverAddress matches with different casing", async () => { const result = await stringifyAndParse(validPayload, { receiverAddress: validWebhook.data.receiver.toUpperCase(), }); expect(result).toEqual(validWebhook); });
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (3)
.changeset/mean-pants-beam.md(1 hunks)packages/thirdweb/src/bridge/Webhook.test.ts(1 hunks)packages/thirdweb/src/bridge/Webhook.ts(2 hunks)
🧰 Additional context used
📓 Path-based instructions (5)
**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{ts,tsx}: Write idiomatic TypeScript with explicit function declarations and return types
Limit each file to one stateless, single-responsibility function for clarity
Re-use shared types from@/typesor localtypes.tsbarrels
Prefer type aliases over interface except for nominal shapes
Avoidanyandunknownunless unavoidable; narrow generics when possible
Choose composition over inheritance; leverage utility types (Partial,Pick, etc.)
Comment only ambiguous logic; avoid restating TypeScript in prose
**/*.{ts,tsx}: Use explicit function declarations and explicit return types in TypeScript
Limit each file to one stateless, single‑responsibility function
Re‑use shared types from@/typeswhere applicable
Prefertypealiases overinterfaceexcept for nominal shapes
Avoidanyandunknownunless unavoidable; narrow generics when possible
Prefer composition over inheritance; use utility types (Partial, Pick, etc.)
Lazy‑import optional features and avoid top‑level side‑effects to reduce bundle size
Files:
packages/thirdweb/src/bridge/Webhook.tspackages/thirdweb/src/bridge/Webhook.test.ts
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (CLAUDE.md)
Load heavy dependencies inside async paths to keep initial bundle lean (lazy loading)
Files:
packages/thirdweb/src/bridge/Webhook.tspackages/thirdweb/src/bridge/Webhook.test.ts
packages/thirdweb/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
packages/thirdweb/**/*.{ts,tsx}: Every public symbol must have comprehensive TSDoc with at least one compiling@exampleand a custom tag (@beta,@internal,@experimental, etc.)
Comment only ambiguous logic; avoid restating TypeScript in prose
Lazy‑load heavy dependencies inside async paths (e.g.,const { jsPDF } = await import("jspdf"))
Files:
packages/thirdweb/src/bridge/Webhook.tspackages/thirdweb/src/bridge/Webhook.test.ts
**/*.test.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.test.{ts,tsx}: Place tests alongside code:foo.ts↔foo.test.ts
Use real function invocations with stub data in tests; avoid brittle mocks
Use Mock Service Worker (MSW) for fetch/HTTP call interception in tests
Keep tests deterministic and side-effect free
UseFORKED_ETHEREUM_CHAINfor mainnet interactions andANVIL_CHAINfor isolated tests
**/*.test.{ts,tsx}: Co‑locate tests asfoo.test.ts(x)next to the implementation
Use real function invocations with stub data; avoid brittle mocks
Use MSW to intercept HTTP calls for network interactions; mock only hard‑to‑reproduce scenarios
Keep tests deterministic and side‑effect free; use Vitest
Files:
packages/thirdweb/src/bridge/Webhook.test.ts
.changeset/*.md
📄 CodeRabbit inference engine (AGENTS.md)
.changeset/*.md: Each change inpackages/*must include a changeset for the appropriate package
Version bump rules: patch for non‑API changes; minor for new/modified public API
Files:
.changeset/mean-pants-beam.md
🧠 Learnings (1)
📚 Learning: 2025-06-26T19:46:04.024Z
Learnt from: gregfromstl
Repo: thirdweb-dev/js PR: 7450
File: packages/thirdweb/src/bridge/Webhook.ts:57-81
Timestamp: 2025-06-26T19:46:04.024Z
Learning: In the onramp webhook schema (`packages/thirdweb/src/bridge/Webhook.ts`), the `currencyAmount` field is intentionally typed as `z.number()` while other amount fields use `z.string()` because `currencyAmount` represents fiat currency amounts in decimals (like $10.50), whereas other amount fields represent token amounts in wei (very large integers that benefit from bigint representation). The different naming convention (`currencyAmount` vs `amount`) reflects this intentional distinction.
Applied to files:
packages/thirdweb/src/bridge/Webhook.tspackages/thirdweb/src/bridge/Webhook.test.ts
🧬 Code graph analysis (1)
packages/thirdweb/src/bridge/Webhook.test.ts (1)
packages/thirdweb/src/bridge/Webhook.ts (2)
parse(101-294)WebhookPayload(87-90)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
- GitHub Check: Unit Tests
- GitHub Check: Size
- GitHub Check: E2E Tests (pnpm, vite)
- GitHub Check: E2E Tests (pnpm, esbuild)
- GitHub Check: E2E Tests (pnpm, webpack)
- GitHub Check: Lint Packages
- GitHub Check: Build Packages
- GitHub Check: Analyze (javascript)
🔇 Additional comments (5)
packages/thirdweb/src/bridge/Webhook.test.ts (3)
623-639: LGTM! Well-designed test helpers.The
stringifyAndParsehelper function is clean and reusable. UsingParameters<typeof parse>[4]to extract theVerifyOptionstype is a nice way to maintain type safety without duplicating type definitions.
641-647: LGTM! Concise helper for failure cases.The
expectVerifyFailurehelper reduces duplication across test cases and makes the tests more readable.
697-777: LGTM! Comprehensive onramp transaction coverage.The onramp verification tests mirror the onchain tests and properly exercise both branches of the verification logic, ensuring the discriminated union handling works correctly.
packages/thirdweb/src/bridge/Webhook.ts (1)
208-291: LGTM! Verification logic is correct and well-structured.The verification implementation properly handles both onchain and onramp transaction types using discriminated union type narrowing. The case-insensitive address comparison and descriptive error messages are good practices.
The comparison logic on lines 275 and 284 correctly checks if
actual < minimumto fail verification, which matches the expected behavior forminDestinationAmount..changeset/mean-pants-beam.md (1)
7-22: LGTM! Clear and helpful example.The example code effectively demonstrates the usage of the new
verifyparameter.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8395 +/- ##
==========================================
+ Coverage 54.77% 54.82% +0.05%
==========================================
Files 919 919
Lines 60768 60840 +72
Branches 4119 4140 +21
==========================================
+ Hits 33284 33356 +72
Misses 27382 27382
Partials 102 102
🚀 New features to boost your workflow:
|
size-limit report 📦
|
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
packages/thirdweb/src/bridge/Webhook.ts (1)
122-142: Fix documentation issues and add required @example.Several documentation improvements needed:
- Line 127: Remove duplicate "the" → "Verify that the payload's destination token amount..."
- Line 127: The comment states "greater than" but the implementation (lines 275, 284) uses
<which enforces>=(greater than or equal to). Update to "greater than or equal to" for accuracy.- Missing @example: The main function's TSDoc (around lines 92-100) still lacks a compiling
@exampledemonstrating theverifyparameter usage, as required by coding guidelines. Consider adding an example similar to the one in.changeset/mean-pants-beam.md.As per coding guidelines
Apply this diff to fix the issues:
/** - * Add various validations to the parsed payload to ensure it matches the expected values. Throws error if any validation fails. + * When provided, validates the parsed payload against expected values. Throws an error if any validation fails. */ verify?: { /** - * Verify that the payload's the destination token amount (in wei) is greater than `minDestinationAmount` value + * Verify that the payload's destination token amount (in wei) is greater than or equal to `minDestinationAmount` value */ minDestinationAmount?: bigint;
🧹 Nitpick comments (1)
packages/thirdweb/src/bridge/Webhook.ts (1)
208-291: Consider using type-based discrimination for consistency.The verification logic correctly handles both onchain and onramp transactions. However, since
parsedPayloadis a discriminated union bytype(line 83), you could useparsedPayload.type === "pay.onchain-transaction"instead of field-presence checks like"destinationToken" in parsedPayload.data. This would be more aligned with the discriminated union pattern and provide better type narrowing.Example refactor for destinationTokenAddress validation:
if (verify.destinationTokenAddress) { if (parsedPayload.type === "pay.onchain-transaction") { if ( parsedPayload.data.destinationToken.address.toLowerCase() !== verify.destinationTokenAddress.toLowerCase() ) { throw new Error( `Verification Failed: destinationTokenAddress mismatch, Expected: ${verify.destinationTokenAddress}, Received: ${parsedPayload.data.destinationToken.address}`, ); } } else if (parsedPayload.type === "pay.onramp-transaction") { if ( parsedPayload.data.token.address.toLowerCase() !== verify.destinationTokenAddress.toLowerCase() ) { throw new Error( `Verification Failed: destinationTokenAddress mismatch, Expected: ${verify.destinationTokenAddress}, Received: ${parsedPayload.data.token.address}`, ); } } }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (3)
.changeset/mean-pants-beam.md(1 hunks)packages/thirdweb/src/bridge/Webhook.test.ts(1 hunks)packages/thirdweb/src/bridge/Webhook.ts(2 hunks)
🚧 Files skipped from review as they are similar to previous changes (2)
- .changeset/mean-pants-beam.md
- packages/thirdweb/src/bridge/Webhook.test.ts
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{ts,tsx}: Write idiomatic TypeScript with explicit function declarations and return types
Limit each file to one stateless, single-responsibility function for clarity
Re-use shared types from@/typesor localtypes.tsbarrels
Prefer type aliases over interface except for nominal shapes
Avoidanyandunknownunless unavoidable; narrow generics when possible
Choose composition over inheritance; leverage utility types (Partial,Pick, etc.)
Comment only ambiguous logic; avoid restating TypeScript in prose
**/*.{ts,tsx}: Use explicit function declarations and explicit return types in TypeScript
Limit each file to one stateless, single‑responsibility function
Re‑use shared types from@/typeswhere applicable
Prefertypealiases overinterfaceexcept for nominal shapes
Avoidanyandunknownunless unavoidable; narrow generics when possible
Prefer composition over inheritance; use utility types (Partial, Pick, etc.)
Lazy‑import optional features and avoid top‑level side‑effects to reduce bundle size
Files:
packages/thirdweb/src/bridge/Webhook.ts
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (CLAUDE.md)
Load heavy dependencies inside async paths to keep initial bundle lean (lazy loading)
Files:
packages/thirdweb/src/bridge/Webhook.ts
packages/thirdweb/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
packages/thirdweb/**/*.{ts,tsx}: Every public symbol must have comprehensive TSDoc with at least one compiling@exampleand a custom tag (@beta,@internal,@experimental, etc.)
Comment only ambiguous logic; avoid restating TypeScript in prose
Lazy‑load heavy dependencies inside async paths (e.g.,const { jsPDF } = await import("jspdf"))
Files:
packages/thirdweb/src/bridge/Webhook.ts
🧠 Learnings (5)
📚 Learning: 2025-06-26T19:46:04.024Z
Learnt from: gregfromstl
Repo: thirdweb-dev/js PR: 7450
File: packages/thirdweb/src/bridge/Webhook.ts:57-81
Timestamp: 2025-06-26T19:46:04.024Z
Learning: In the onramp webhook schema (`packages/thirdweb/src/bridge/Webhook.ts`), the `currencyAmount` field is intentionally typed as `z.number()` while other amount fields use `z.string()` because `currencyAmount` represents fiat currency amounts in decimals (like $10.50), whereas other amount fields represent token amounts in wei (very large integers that benefit from bigint representation). The different naming convention (`currencyAmount` vs `amount`) reflects this intentional distinction.
Applied to files:
packages/thirdweb/src/bridge/Webhook.ts
📚 Learning: 2025-07-18T19:19:55.613Z
Learnt from: CR
Repo: thirdweb-dev/js PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-07-18T19:19:55.613Z
Learning: Applies to packages/thirdweb/src/exports/** : Every public symbol must have comprehensive TSDoc with at least one `example` block that compiles and custom annotation tags (`beta`, `internal`, `experimental`)
Applied to files:
packages/thirdweb/src/bridge/Webhook.ts
📚 Learning: 2025-08-29T15:37:38.513Z
Learnt from: CR
Repo: thirdweb-dev/js PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-08-29T15:37:38.513Z
Learning: Applies to packages/thirdweb/**/*.{ts,tsx} : Every public symbol must have comprehensive TSDoc with at least one compiling `example` and a custom tag (`beta`, `internal`, `experimental`, etc.)
Applied to files:
packages/thirdweb/src/bridge/Webhook.ts
📚 Learning: 2025-08-29T15:37:38.513Z
Learnt from: CR
Repo: thirdweb-dev/js PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-08-29T15:37:38.513Z
Learning: Applies to packages/thirdweb/**/*.{ts,tsx} : Comment only ambiguous logic; avoid restating TypeScript in prose
Applied to files:
packages/thirdweb/src/bridge/Webhook.ts
📚 Learning: 2025-07-18T19:19:55.613Z
Learnt from: CR
Repo: thirdweb-dev/js PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-07-18T19:19:55.613Z
Learning: Applies to **/*.{ts,tsx} : Comment only ambiguous logic; avoid restating TypeScript in prose
Applied to files:
packages/thirdweb/src/bridge/Webhook.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
- GitHub Check: Size
- GitHub Check: E2E Tests (pnpm, esbuild)
- GitHub Check: E2E Tests (pnpm, webpack)
- GitHub Check: E2E Tests (pnpm, vite)
- GitHub Check: Unit Tests
- GitHub Check: Lint Packages
- GitHub Check: Build Packages
- GitHub Check: Analyze (javascript)
Merge activity
|
<!--
## title your PR with this format: "[SDK/Dashboard/Portal] Feature/Fix: Concise title for the changes"
If you did not copy the branch name from Linear, paste the issue tag here (format is TEAM-0000):
## Notes for the reviewer
Anything important to call out? Be sure to also clarify these in your comments.
## How to test
Unit tests, playground, etc.
-->
<!-- start pr-codex -->
---
## PR-Codex overview
This PR adds a `verify` parameter to the `Bridge.Webhook.parse` function in the `thirdweb` library, allowing for validation of webhook payloads against specified criteria such as receiver address, destination token address, chain ID, and minimum destination amount.
### Detailed summary
- Introduced `verify` parameter in `Bridge.Webhook.parse` function.
- Added validation checks for:
- `receiverAddress`
- `destinationTokenAddress`
- `destinationChainId`
- `minDestinationAmount`
- Enhanced error handling for mismatched values.
- Updated tests to cover verification scenarios for both onchain and onramp transactions.
> ✨ Ask PR-Codex anything about this PR by commenting with `/codex {your question}`
<!-- end pr-codex -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **New Features**
* Webhook parsing now supports optional payload verification: enforce receiver address (case-insensitive), destination token, destination chain ID, and minimum destination amount. Verification works for both on-chain and on-ramp payloads and returns descriptive errors on mismatch to help ensure incoming webhooks meet your requirements.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
graphite-app
bot
force-pushed
the
mny-308
branch
from
896763d to
a54c1ab
Compare
PR-Codex overview
This PR adds a
verifyparameter to theBridge.Webhook.parsefunction, enabling validation of webhook payloads against specified criteria, enhancing security and ensuring data integrity.Detailed summary
verifyparameter inBridge.Webhook.parsefunction.receiverAddressdestinationTokenAddressdestinationChainIdminDestinationAmountSummary by CodeRabbit
New Features
Tests