feat: add verify webhooks (#636)

Author: bukinoshita

package.json

@@ -43,6 +43,9 @@
     "url": "https://github.com/resendlabs/resend-node/issues"
   },
   "homepage": "https://github.com/resendlabs/resend-node#readme",
+  "dependencies": {
+    "svix": "1.76.1"
+  },
   "peerDependencies": {
     "@react-email/render": "*"
   },

pnpm-lock.yaml

@@ -10,6 +10,7 @@ import { Contacts } from './contacts/contacts';
 import { Domains } from './domains/domains';
 import { Emails } from './emails/emails';
 import type { ErrorResponse } from './interfaces';
+import { Webhooks } from './webhooks/webhooks';
 
 const defaultBaseUrl = 'https://api.resend.com';
 const defaultUserAgent = `resend-node:${version}`;
@@ -32,6 +33,7 @@ export class Resend {
   readonly contacts = new Contacts(this);
   readonly domains = new Domains(this);
   readonly emails = new Emails(this);
+  readonly webhooks = new Webhooks();
 
   constructor(readonly key?: string) {
     if (!key) {

src/resend.ts

@@ -0,0 +1,51 @@
+import { Webhook } from 'svix';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { Webhooks } from './webhooks';
+
+const mocks = vi.hoisted(() => {
+  const verify = vi.fn();
+  const webhookConstructor = vi.fn(() => ({
+    verify,
+  }));
+
+  return {
+    verify,
+    webhookConstructor,
+  };
+});
+
+vi.mock('svix', () => ({
+  Webhook: mocks.webhookConstructor,
+}));
+
+describe('Webhooks', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.verify.mockReset();
+  });
+
+  it('verifies payload using svix headers', () => {
+    const options = {
+      payload: '{"type":"email.sent"}',
+      headers: {
+        id: 'msg_123',
+        timestamp: '1713984875',
+        signature: 'v1,some-signature',
+      },
+      webhookSecret: 'whsec_123',
+    };
+
+    const expectedResult = { id: 'msg_123', status: 'verified' };
+    mocks.verify.mockReturnValue(expectedResult);
+
+    const result = new Webhooks().verify(options);
+
+    expect(Webhook).toHaveBeenCalledWith(options.webhookSecret);
+    expect(mocks.verify).toHaveBeenCalledWith(options.payload, {
+      'svix-id': options.headers.id,
+      'svix-timestamp': options.headers.timestamp,
+      'svix-signature': options.headers.signature,
+    });
+    expect(result).toBe(expectedResult);
+  });
+});

src/webhooks/webhooks.spec.ts

@@ -0,0 +1,24 @@
+import { Webhook } from 'svix';
+
+interface Headers {
+  id: string;
+  timestamp: string;
+  signature: string;
+}
+
+interface VerifyWebhookOptions {
+  payload: string;
+  headers: Headers;
+  webhookSecret: string;
+}
+
+export class Webhooks {
+  verify(payload: VerifyWebhookOptions) {
+    const webhook = new Webhook(payload.webhookSecret);
+    return webhook.verify(payload.payload, {
+      'svix-id': payload.headers.id,
+      'svix-timestamp': payload.headers.timestamp,
+      'svix-signature': payload.headers.signature,
+    });
+  }
+}