@ted/webhook-consumer

Webhook Consumer SDK for TED/TSentinel:

• HMAC signature verification
• timestamp replay protection
• idempotency helpers
• Express middleware with raw body capture

Install

npm i @ted/webhook-consumer

Express Usage

const express = require("express");
const { tedWebhookMiddleware } = require("@ted/webhook-consumer");

const app = express();
app.post(
  "/webhooks/ted",
  ...tedWebhookMiddleware({
    secret: process.env.TED_WEBHOOK_SECRET,
    toleranceSec: 300,
    enableIdempotency: true,
  }),
  (req, res) => {
    const event = req.tedWebhook.event;
    console.log(event.event, event.data);
    res.status(200).json({ ok: true });
  },
);

Signature

Expected signature header: x-ted-signature Computed as: hex(hmac_sha256(secret, "${x-ted-timestamp}.${rawBody}"))

Idempotency

Uses x-idempotency-key if provided, otherwise event.id. For production, use a shared store (Redis/DB unique index).