Add secure Node image webhook service

node-hook/test/auth.test.mjs

@@ -0,0 +1,23 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { adminSignature, hmacHex, verifyAdminSignature, verifyHexHmac } from '../src/auth.mjs';
+
+test('Gitea HMAC verifies the exact raw body', () => {
+  const body = Buffer.from('{"ref":"refs/heads/master"}');
+  const signature = hmacHex('a'.repeat(32), body);
+  assert.equal(verifyHexHmac('a'.repeat(32), body, signature), true);
+  assert.equal(verifyHexHmac('a'.repeat(32), Buffer.from(`${body} `), signature), false);
+  assert.equal(verifyHexHmac('a'.repeat(32), body, 'not-a-signature'), false);
+});
+
+test('admin signatures bind timestamp, request ID, and body with a five-minute window', () => {
+  const secret = 'b'.repeat(32);
+  const now = 1_786_013_000_000;
+  const timestamp = String(now);
+  const requestId = 'request-1234';
+  const body = Buffer.from('{"branch":"master"}');
+  const supplied = adminSignature(secret, timestamp, requestId, body);
+  assert.equal(verifyAdminSignature({ secret, timestamp, requestId, body, supplied, now }), true);
+  assert.equal(verifyAdminSignature({ secret, timestamp: String(now - 300_001), requestId, body, supplied, now }), false);
+  assert.equal(verifyAdminSignature({ secret, timestamp, requestId: 'changed-id', body, supplied, now }), false);
+});