feat: add Cal.com webhook validator

README.md

@@ -14,7 +14,7 @@ A simple nuxt module that works on the edge to easily validate incoming webhooks
 
 ## Features
 
-- 23 [Webhook validators](#supported-webhook-validators)
+- 24 [Webhook validators](#supported-webhook-validators)
 - Works on the edge
 - Exposed [Server utils](#server-utils)
 
@@ -80,6 +80,7 @@ Go to [playground/.env.example](./playground/.env.example) or [playground/nuxt.c
 
 - Bitbucket
 - Brevo
+- Cal.com
 - Discord
 - Dropbox
 - Fourthwall

playground/.env.example

@@ -4,6 +4,9 @@ NUXT_WEBHOOK_BITBUCKET_SECRET_KEY=
 # Brevo Validator
 NUXT_WEBHOOK_BREVO_TOKEN=
 
+# Cal.com Validator
+NUXT_WEBHOOK_CALCOM_SECRET_KEY=
+
 # Discord Validator
 NUXT_WEBHOOK_DISCORD_PUBLIC_KEY=
 

playground/nuxt.config.ts

@@ -14,6 +14,9 @@ export default defineNuxtConfig({
       brevo: {
         token: '',
       },
+      calcom: {
+        secretKey: '',
+      },
       discord: {
         publicKey: '',
       },

playground/server/api/webhooks/calcom.post.ts

@@ -0,0 +1,7 @@
+export default defineEventHandler(async (event) => {
+  const isValidWebhook = await isValidCalcomWebhook(event)
+
+  if (!isValidWebhook) throw createError({ status: 401, message: 'Unauthorized: webhook is not valid' })
+
+  return { isValidWebhook }
+})

src/module.ts

@@ -28,6 +28,10 @@ export default defineNuxtModule<ModuleOptions>({
     runtimeConfig.webhook.brevo = defu(runtimeConfig.webhook.brevo, {
       token: '',
     })
+    // Cal.com Webhook
+    runtimeConfig.webhook.calcom = defu(runtimeConfig.webhook.calcom, {
+      secretKey: '',
+    })
     // Discord Webhook
     runtimeConfig.webhook.discord = defu(runtimeConfig.webhook.discord, {
       publicKey: '',

src/runtime/server/lib/validators/calcom.post.ts

@@ -0,0 +1,23 @@
+import { type H3Event, getRequestHeaders } from 'h3'
+import { computeSignature, HMAC_SHA256, ensureConfiguration, readRawBodyClone } from '../utils'
+
+const CALCOM_SIGNATURE = 'X-Cal-Signature-256'.toLowerCase()
+
+/**
+ * Validates Cal.com webhooks on the Edge
+ * @see {@link https://cal.com/docs/developing/guides/automation/webhooks#verifying-the-authenticity-of-the-received-payload}
+ * @param event H3Event
+ * @returns {boolean} `true` if the webhook is valid, `false` otherwise
+ */
+export const isValidCalcomWebhook = async (event: H3Event): Promise<boolean> => {
+  const config = ensureConfiguration('calcom', event)
+
+  const headers = getRequestHeaders(event)
+  const body = await readRawBodyClone(event)
+  const signature = headers[CALCOM_SIGNATURE]
+
+  if (!signature || !body) return false
+
+  const computedHash = await computeSignature(config.secretKey, HMAC_SHA256, body)
+  return signature === computedHash
+}

test/events.ts

@@ -1,5 +1,6 @@
 export { simulateBitbucketEvent } from './simulations/bitbucket'
 export { simulateBrevoEvent } from './simulations/brevo'
+export { simulateCalcomEvent } from './simulations/calcom'
 export { simulateDiscordEvent } from './simulations/discord'
 export { simulateDropboxEvent } from './simulations/dropbox'
 export { simulateFourthwallEvent } from './simulations/fourthwall'

test/fixtures/basic/nuxt.config.ts

@@ -13,6 +13,9 @@ export default defineNuxtConfig({
       brevo: {
         token: 'testToken',
       },
+      calcom: {
+        secretKey: 'testCalcomSecretKey',
+      },
       discord: {
         publicKey: 'fcf4594ff55a5898a7e7ce541b93dc8ce618c7a4fa96ab7efd1ac2890571345c',
       },

test/simulations/calcom.ts

@@ -0,0 +1,24 @@
+import { subtle } from 'node:crypto'
+import { Buffer } from 'node:buffer'
+import { $fetch } from '@nuxt/test-utils/e2e'
+import { encoder, HMAC_SHA256 } from '../../src/runtime/server/lib/utils'
+import nuxtConfig from '../fixtures/basic/nuxt.config'
+
+const body = { data: 'testBody' }
+const secretKey = nuxtConfig.runtimeConfig?.webhook?.calcom?.secretKey
+
+export const simulateCalcomEvent = async () => {
+  const signature = await subtle.importKey('raw', encoder.encode(secretKey), HMAC_SHA256, false, ['sign'])
+  const hmac = await subtle.sign(HMAC_SHA256.name, signature, encoder.encode(JSON.stringify(body)))
+  const validSignature = Buffer.from(hmac).toString('hex')
+
+  const headers = {
+    'X-Cal-Signature-256': validSignature,
+  }
+
+  return $fetch<{ isValidWebhook: boolean }>('/api/webhooks/calcom', {
+    method: 'POST',
+    headers,
+    body,
+  })
+}