🥮 mooncakes.io

    moon_webhook_guard

    MoonBit Webhook signature verification, replay protection, idempotency, and event routing toolkit.

    webhook
    signature
    security
    idempotency
    moonbit
    Download zip
    Author
    Version
    0.2.0
    License
    MIT
    Repository
    Last updated
    2 months ago
    Downloads
    30

    #moon_webhook_guard

    moon_webhook_guard is a MoonBit toolkit for building safer Webhook receivers. It focuses on the receiving side: canonical payloads, signature verification, timestamp windows, nonce replay checks, idempotency keys, event routing, provider profiles, diagnostics, fixtures, and test helpers.

    Repository: https://github.com/mxz1234/12312

    #Why This Project

    MoonBit already has cryptographic and HTTP-related building blocks, but Webhook receivers still need a reusable security workflow. This project does not try to replace crypto libraries or web servers. It wraps the Webhook verification process into a MoonBit-native package that can be embedded by services, CLI tools, workers, and demos.

    #Features

    • Request, header, provider, event, verification policy, and diagnostic models.
    • Canonical string builders for raw body, timestamp, provider, event type, and id.
    • HMAC-SHA256 verification backed by moonbitlang/x/crypto.
    • Timestamp tolerance, nonce replay protection, idempotency, and duplicate event checks.
    • Event router with provider, event type, path, and method matching.
    • GitHub raw-body HMAC, Stripe timestamped HMAC, Feishu callback digest, and generic HMAC profiles.
    • Structured JSON parsing, nested metadata extraction, schema validation, and provider cookbooks.
    • Fixture builders, batch verification, reports, risk scoring, audit logs, and Markdown/CSV export.
    • Response planning, endpoint documentation generation, admission decisions, and debug snapshots.
    • Runnable example in cmd/main and MoonBit regression tests.

    #Quick Start

    moon check
moon test
moon run cmd/main

    let request = example_github_request()
    let output = run_guard_pipeline(request, GuardConfig::default())
    println(pipeline_output_text(output))

    #Scope

    The security path uses SHA-256 and HMAC-SHA256 primitives from the official moonbitlang/x/crypto package. GitHub signatures cover the unmodified raw body; Stripe signatures cover timestamp.raw_body and support multiple v1 values during secret rotation. Secrets must be supplied by the host application and must not be committed to source control.

    The MVP intentionally focuses on reusable Webhook receiver workflow rather than being an HTTP server, a general HMAC package, or a rate limiter. It covers the guard layer that sits between an HTTP framework and application handlers.

    Current MVP status:

    • 4,000+ lines of effective MoonBit source.
    • 74 regression tests covering official HMAC vectors, signature tampering, provider metadata, structured JSON, replay protection, routing, provider profiles, reports, risk scoring, payload validation, audit logs, receiver workflow, and generated integration docs.
    • No mechanically generated repeated sample set is used to inflate size.

    #MVP Modules

    • model.mbt, canonical.mbt, signing.mbt, signature_header.mbt: request model, provider profile, canonical payload, HMAC-SHA256, signature parsing, and timing-resistant comparison.
    • verifier.mbt, store.mbt: signature verification, timestamp window, replay store, idempotency store, and batch verification.
    • router.mbt, pipeline.mbt, plan.mbt, response.mbt: event routing, stateful guard pipeline, handler action plan, and response mapping.
    • providers.mbt, provider_adapter.mbt, parser.mbt, payload.mbt, schema.mbt: provider normalization, Stripe signature parsing, structured JSON navigation, and event schema validation.
    • risk.mbt, quality.mbt, audit.mbt, errors.mbt, debug.mbt: risk scoring, config quality checks, audit chain, remediation text, and debug snapshots.
    • reports.mbt, manifest.mbt, endpoint.mbt, cookbook.mbt, testkit.mbt: reports, manifest, endpoint docs, provider cookbook, and scenario tests.
    • receiver.mbt, integration.mbt: end-to-end receiver workflow and generated integration guide.

    #License

    MIT License.

    See THIRD_PARTY.md for dependency provenance and SECURITY.md for the supported security boundary.

    ActionKind

    source
    pub(all) enum ActionKind {
      Acknowledge
      Reject
      Ignore
      Dispatch
      RetryLater
    } derive(Eq, 
    Debug    )

    AdmissionCounter

    source
    pub struct AdmissionCounter {
      provider : String
      window_start : Int
      count : Int
    } derive(Eq, 
    Debug    )

    AdmissionCounter::new

    source
    fn AdmissionCounter::new(provider : String, window_start : Int, count : Int) -> AdmissionCounter

    AdmissionDecision

    source
    pub struct AdmissionDecision {
      allowed : Bool
      reason : String
      state : AdmissionState
    } derive(Eq, 
    Debug    )

    AdmissionDecision::new

    source
    fn AdmissionDecision::new(allowed : Bool, reason : String, state : AdmissionState) -> AdmissionDecision

    AdmissionRule

    source
    pub struct AdmissionRule {
      provider : String
      max_events_per_window : Int
      window_seconds : Int
    } derive(Eq, 
    Debug    )

    AdmissionRule::new

    source
    fn AdmissionRule::new(provider : String, max_events_per_window : Int, window_seconds : Int) -> AdmissionRule

    AdmissionState

    source
    pub struct AdmissionState {
      counters : Array[AdmissionCounter]
    } derive(Eq, 
    Debug    )

    AdmissionState::empty

    source

    AuditRecord

    source
    pub struct AuditRecord {
      sequence : Int
      event_id : String
      provider : String
      status : String
      risk_level : String
      route_handler : String
      digest : String
    } derive(Eq, 
    Debug    )

    AuditRecord::new

    source
    fn AuditRecord::new(sequence : Int, event_id : String, provider : String, status : String, risk_level : String, route_handler : String, digest : String) -> AuditRecord

    BatchReport

    source
    pub struct BatchReport {
      results : Array[VerificationResult]
    } derive(Eq, 
    Debug    )

    BatchReport::acceptance_rate

    source
    fn BatchReport::acceptance_rate(self : BatchReport) -> Double

    BatchReport::accepted

    source
    fn BatchReport::accepted(self : BatchReport) -> Int

    BatchReport::new

    source

    BatchReport::rejected

    source
    fn BatchReport::rejected(self : BatchReport) -> Int

    BatchReport::total

    source
    fn BatchReport::total(self : BatchReport) -> Int

    DebugSnapshot

    source
    pub struct DebugSnapshot {
      canonical : String
      expected_signature : String
      actual_signature : String
      masked_secret : String
      headers : String
    } derive(Eq, 
    Debug    )

    DebugSnapshot::new

    source
    fn DebugSnapshot::new(canonical : String, expected_signature : String, actual_signature : String, masked_secret : String, headers : String) -> DebugSnapshot

    DiagnosticCode

    source
    pub(all) enum DiagnosticCode {
      MissingSignature
      SignatureMismatch
      MissingTimestamp
      TimestampOutsideWindow
      MissingEventId
      ReplayDetected
      DuplicateIdempotencyKey
      UnknownEvent
      ProviderMismatch
      AcceptedDiagnostic
    } derive(Eq, 
    Debug    )

    DispatchOutcome

    source
    pub struct DispatchOutcome {
      verification : VerificationResult
      route : RouteDecision
    } derive(Eq, 
    Debug    )

    DuplicateGroup

    source
    pub struct DuplicateGroup {
      event_id : String
      count : Int
    } derive(Eq, 
    Debug    )

    DuplicateGroup::new

    source
    fn DuplicateGroup::new(event_id : String, count : Int) -> DuplicateGroup

    EndpointSpec

    source
    pub struct EndpointSpec {
      provider : String
      path : String
      http_method : HttpMethod
      headers : Array[String]
      events : Array[String]
    } derive(Eq, 
    Debug    )

    EndpointSpec::new

    source
    fn EndpointSpec::new(provider : String, path : String, http_method : HttpMethod, headers : Array[String], events : Array[String]) -> EndpointSpec

    ErrorCategory

    source
    pub(all) enum ErrorCategory {
      Authentication
      Freshness
      Identity
      Routing
      ProviderConfig
      Replay
      UnknownCategory
    } derive(Eq, 
    Debug    )

    EventRouter

    source
    pub struct EventRouter {
      rules : Array[RouteRule]
    } derive(Eq, 
    Debug    )

    EventRouter::add

    source
    fn EventRouter::add(self : EventRouter, rule : RouteRule) -> EventRouter

    EventRouter::empty

    source
    fn EventRouter::empty() -> EventRouter

    EventRouter::enabled_count

    source
    fn EventRouter::enabled_count(self : EventRouter) -> Int

    EventRouter::handlers

    source
    fn EventRouter::handlers(self : EventRouter) -> Array[String]

    EventRouter::route

    source
    fn EventRouter::route(self : EventRouter, request : WebhookRequest, profile : ProviderProfile) -> RouteDecision

    GateStatus

    source
    pub(all) enum GateStatus {
      Pass
      Warn
      Fail
    } derive(Eq, 
    Debug    )

    GuardConfig

    source
    pub struct GuardConfig {
      policy : VerificationPolicy
      router : EventRouter
      state : GuardState
    } derive(Eq, 
    Debug    )

    GuardConfig::default

    source
    fn GuardConfig::default() -> GuardConfig

    GuardConfig::for_provider

    source
    fn GuardConfig::for_provider(provider_name : String, secret : String, now : Int) -> GuardConfig

    GuardConfig::new

    source
    fn GuardConfig::new(policy : VerificationPolicy, router : EventRouter, state? : GuardState) -> GuardConfig

    GuardConfig::with_policy

    source
    fn GuardConfig::with_policy(self : GuardConfig, policy : VerificationPolicy) -> GuardConfig

    GuardConfig::with_router

    source
    fn GuardConfig::with_router(self : GuardConfig, router : EventRouter) -> GuardConfig

    GuardConfig::with_state

    source
    fn GuardConfig::with_state(self : GuardConfig, state : GuardState) -> GuardConfig

    GuardDiagnostic

    source
    pub struct GuardDiagnostic {
      code : DiagnosticCode
      message : String
    } derive(Eq, 
    Debug    )

    GuardDiagnostic::new

    source
    fn GuardDiagnostic::new(code : DiagnosticCode, message : String) -> GuardDiagnostic

    GuardManifest

    source
    pub struct GuardManifest {
      name : String
      version : String
      providers : Array[String]
      routes : Int
      checks : Array[String]
    } derive(Eq, 
    Debug    )

    GuardManifest::new

    source
    fn GuardManifest::new(name : String, version : String, providers : Array[String], routes : Int, checks : Array[String]) -> GuardManifest

    GuardPipelineOutput

    source
    pub struct GuardPipelineOutput {
      verification : VerificationResult
      route : RouteDecision
      risk : RiskScore
      state : GuardState
    } derive(Eq, 
    Debug    )

    GuardQualityReport

    source
    pub struct GuardQualityReport {
      gates : Array[QualityGate]
    } derive(Eq, 
    Debug    )

    GuardQualityReport::fail_count

    source
    fn GuardQualityReport::fail_count(self : GuardQualityReport) -> Int

    GuardQualityReport::is_ready

    source
    fn GuardQualityReport::is_ready(self : GuardQualityReport) -> Bool

    GuardQualityReport::pass_count

    source
    fn GuardQualityReport::pass_count(self : GuardQualityReport) -> Int

    GuardState

    source
    pub struct GuardState {
      replay_store : ReplayStore
      idempotency_store : IdempotencyStore
    } derive(Eq, 
    Debug    )

    GuardState::empty

    source
    fn GuardState::empty() -> GuardState

    GuardState::remember

    source
    fn GuardState::remember(self : GuardState, request : WebhookRequest, policy : VerificationPolicy) -> GuardState

    HandlerAction

    source
    pub struct HandlerAction {
      kind : ActionKind
      handler : String
      reason : String
    } derive(Eq, 
    Debug    )

    HandlerAction::new

    source
    fn HandlerAction::new(kind : ActionKind, handler : String, reason : String) -> HandlerAction

    HandlingPlan

    source
    pub struct HandlingPlan {
      actions : Array[HandlerAction]
      response : WebhookResponse
    } derive(Eq, 
    Debug    )

    HandlingPlan::new

    source
    fn HandlingPlan::new(actions : Array[HandlerAction], response : WebhookResponse) -> HandlingPlan

    pub struct Header {
      name : String
      value : String
    } derive(Eq, 
    Debug    )

    Header::new

    source
    fn Header::new(name : String, value : String) -> Header

    Header::normalized_name

    source
    fn Header::normalized_name(self : Header) -> String

    HttpMethod

    source
    pub(all) enum HttpMethod {
      Get
      Post
      Put
      Patch
      Delete
      Unknown(String)
    } derive(Eq, 
    Debug    )

    IdempotencyStore

    source
    pub struct IdempotencyStore {
      entries : Array[SeenEntry]
    } derive(Eq, 
    Debug    )

    IdempotencyStore::contains

    source
    fn IdempotencyStore::contains(self : IdempotencyStore, key : String, now : Int) -> Bool

    IdempotencyStore::empty

    source

    IdempotencyStore::remember

    source
    fn IdempotencyStore::remember(self : IdempotencyStore, key : String, now : Int, ttl_seconds : Int) -> IdempotencyStore

    IntegrationGuide

    source
    pub struct IntegrationGuide {
      manifest : String
      endpoints : String
      cookbook : String
      quality : String
      scenarios : String
    } derive(Eq, 
    Debug    )

    IntegrationGuide::new

    source
    fn IntegrationGuide::new(manifest : String, endpoints : String, cookbook : String, quality : String, scenarios : String) -> IntegrationGuide

    PayloadDocument

    source
    pub struct PayloadDocument {
      body : String
      json : Json?
      kind : PayloadKind
      error : String
    } derive(Eq, 
    Debug    )

    PayloadDocument::invalid

    source
    fn PayloadDocument::invalid(body : String, error : String) -> PayloadDocument

    PayloadDocument::valid

    source
    fn PayloadDocument::valid(body : String, json : Json) -> PayloadDocument

    PayloadField

    source
    pub struct PayloadField {
      key : String
      value : String
    } derive(Eq, 
    Debug    )

    PayloadField::new

    source
    fn PayloadField::new(key : String, value : String) -> PayloadField

    PayloadKind

    source
    pub(all) enum PayloadKind {
      ObjectPayload
      ArrayPayload
      ScalarPayload
      InvalidPayload
    } derive(Eq, 
    Debug    )

    PayloadRule

    source
    pub struct PayloadRule {
      key : String
      required : Bool
      expected_value : String
    } derive(Eq, 
    Debug    )

    PayloadRule::new

    source
    fn PayloadRule::new(key : String, required? : Bool, expected_value? : String) -> PayloadRule

    PayloadSchema

    source
    pub struct PayloadSchema {
      name : String
      rules : Array[PayloadRule]
    } derive(Eq, 
    Debug    )

    PayloadSchema::new

    source
    fn PayloadSchema::new(name : String, rules : Array[PayloadRule]) -> PayloadSchema

    PayloadValidationError

    source
    pub struct PayloadValidationError {
      key : String
      message : String
    } derive(Eq, 
    Debug    )

    PayloadValidationError::new

    source
    fn PayloadValidationError::new(key : String, message : String) -> PayloadValidationError

    ProviderCapabilities

    source
    pub struct ProviderCapabilities {
      profile : ProviderProfile
      supports_timestamp : Bool
      supports_event_id : Bool
      supports_event_type : Bool
      recommended_window_seconds : Int
      notes : String
    } derive(Eq, 
    Debug    )

    ProviderCapabilities::new

    source
    fn ProviderCapabilities::new(profile : ProviderProfile, supports_timestamp : Bool, supports_event_id : Bool, supports_event_type : Bool, recommended_window_seconds : Int, notes : String) -> ProviderCapabilities

    ProviderProfile

    source
    pub struct ProviderProfile {
      name : String
      signature_header : String
      timestamp_header : String
      event_type_header : String
      event_id_header : String
      signature_prefix : String
      timestamp_tolerance_seconds : Int
    } derive(Eq, 
    Debug    )

    ProviderProfile::feishu

    source

    ProviderProfile::generic

    source

    ProviderProfile::github

    source

    ProviderProfile::new

    source
    fn ProviderProfile::new(name : String, signature_header : String, timestamp_header : String, event_type_header : String, event_id_header : String, signature_prefix? : String, timestamp_tolerance_seconds? : Int) -> ProviderProfile

    ProviderProfile::stripe

    source

    ProviderRequestMetadata

    source
    pub struct ProviderRequestMetadata {
      provider : String
      event_type : String
      event_id : String
      timestamp : Int
      nonce : String
      signature_present : Bool
    } derive(Eq, 
    Debug    )

    ProviderRequestMetadata::new

    source
    fn ProviderRequestMetadata::new(provider : String, event_type : String, event_id : String, timestamp : Int, nonce : String, signature_present : Bool) -> ProviderRequestMetadata

    QualityGate

    source
    pub struct QualityGate {
      name : String
      status : GateStatus
      detail : String
    } derive(Eq, 
    Debug    )

    QualityGate::new

    source
    fn QualityGate::new(name : String, status : GateStatus, detail : String) -> QualityGate

    ReceiverConfig

    source
    pub struct ReceiverConfig {
      guard_config : GuardConfig
      admission_rule : AdmissionRule
      validate_payload : Bool
    } derive(Eq, 
    Debug    )

    ReceiverConfig::default

    source

    ReceiverOutput

    source
    pub struct ReceiverOutput {
      pipeline : GuardPipelineOutput
      plan : HandlingPlan
      payload_errors : Array[PayloadValidationError]
      admission : AdmissionDecision
      state : ReceiverState
    } derive(Eq, 
    Debug    )

    ReceiverState

    source
    pub struct ReceiverState {
      guard_state : GuardState
      admission_state : AdmissionState
      audit_records : Array[AuditRecord]
    } derive(Eq, 
    Debug    )

    ReceiverState::empty

    source

    ReplayStore

    source
    pub struct ReplayStore {
      entries : Array[SeenEntry]
    } derive(Eq, 
    Debug    )

    ReplayStore::contains

    source
    fn ReplayStore::contains(self : ReplayStore, key : String, now : Int) -> Bool

    ReplayStore::empty

    source
    fn ReplayStore::empty() -> ReplayStore

    ReplayStore::prune

    source
    fn ReplayStore::prune(self : ReplayStore, now : Int) -> ReplayStore

    ReplayStore::remember

    source
    fn ReplayStore::remember(self : ReplayStore, key : String, now : Int, ttl_seconds : Int) -> ReplayStore

    RiskScore

    source
    pub struct RiskScore {
      score : Int
      level : String
      reasons : Array[String]
    } derive(Eq, 
    Debug    )

    RiskScore::new

    source
    fn RiskScore::new(score : Int, reasons : Array[String]) -> RiskScore

    RouteDecision

    source
    pub struct RouteDecision {
      matched : Bool
      rule_name : String
      handler : String
      reason : String
    } derive(Eq, 
    Debug    )

    RouteDecision::matched

    source
    fn RouteDecision::matched(rule : RouteRule) -> RouteDecision

    RouteDecision::miss

    source
    fn RouteDecision::miss(reason : String) -> RouteDecision

    RouteRule

    source
    pub struct RouteRule {
      name : String
      provider : String
      event_type : String
      path : String
      http_method : HttpMethod
      handler : String
      enabled : Bool
    } derive(Eq, 
    Debug    )

    RouteRule::matches

    source
    fn RouteRule::matches(self : RouteRule, request : WebhookRequest, profile : ProviderProfile) -> Bool

    RouteRule::new

    source
    fn RouteRule::new(name : String, provider : String, event_type : String, path : String, http_method : HttpMethod, handler : String, enabled? : Bool) -> RouteRule

    Scenario

    source
    pub struct Scenario {
      name : String
      request : WebhookRequest
      expect_ok : Bool
      expected_route : String
    } derive(Eq, 
    Debug    )

    Scenario::new

    source
    fn Scenario::new(name : String, request : WebhookRequest, expect_ok : Bool, expected_route : String) -> Scenario

    ScenarioResult

    source
    pub struct ScenarioResult {
      name : String
      passed : Bool
      detail : String
    } derive(Eq, 
    Debug    )

    SeenEntry

    source
    pub struct SeenEntry {
      key : String
      expires_at : Int
    } derive(Eq, 
    Debug    )

    SeenEntry::new

    source
    fn SeenEntry::new(key : String, expires_at : Int) -> SeenEntry

    SignatureComponent

    source
    pub struct SignatureComponent {
      key : String
      value : String
    } derive(Eq, 
    Debug    )

    SignatureComponent::new

    source
    fn SignatureComponent::new(key : String, value : String) -> SignatureComponent

    StableSignature

    source
    pub struct StableSignature {
      value : String
    } derive(Eq, 
    Debug    )

    StableSignature::new

    source
    fn StableSignature::new(value : String) -> StableSignature

    StripeSignature

    source
    pub struct StripeSignature {
      timestamp : Int
      timestamp_text : String
      v1_signatures : Array[String]
      legacy_signatures : Array[String]
      unknown_components : Array[SignatureComponent]
    } derive(Eq, 
    Debug    )

    StripeSignature::empty

    source

    StripeSignature::is_well_formed

    source
    fn StripeSignature::is_well_formed(self : StripeSignature) -> Bool

    VerificationPolicy

    source
    pub struct VerificationPolicy {
      provider : ProviderProfile
      secret : String
      now : Int
      require_signature : Bool
      require_timestamp : Bool
      require_event_id : Bool
      allow_unknown_event : Bool
    } derive(Eq, 
    Debug    )

    VerificationPolicy::default

    source

    VerificationPolicy::for_provider

    source
    fn VerificationPolicy::for_provider(provider : ProviderProfile) -> VerificationPolicy

    VerificationPolicy::with_clock

    source
    fn VerificationPolicy::with_clock(self : VerificationPolicy, now : Int) -> VerificationPolicy

    VerificationPolicy::with_secret

    source
    fn VerificationPolicy::with_secret(self : VerificationPolicy, secret : String) -> VerificationPolicy

    VerificationPolicy::with_unknown_events

    source
    fn VerificationPolicy::with_unknown_events(self : VerificationPolicy, allowed : Bool) -> VerificationPolicy

    VerificationResult

    source
    pub struct VerificationResult {
      status : VerificationStatus
      provider : String
      event_type : String
      event_id : String
      diagnostics : Array[GuardDiagnostic]
    } derive(Eq, 
    Debug    )

    VerificationResult::accepted

    source
    fn VerificationResult::accepted(provider : String, event_type : String, event_id : String) -> VerificationResult

    VerificationResult::is_ok

    source
    fn VerificationResult::is_ok(self : VerificationResult) -> Bool

    VerificationResult::new

    source
    fn VerificationResult::new(status : VerificationStatus, provider : String, event_type : String, event_id : String, diagnostics? : Array[GuardDiagnostic]) -> VerificationResult

    VerificationResult::rejected

    source
    fn VerificationResult::rejected(provider : String, event_type : String, event_id : String, diagnostics : Array[GuardDiagnostic]) -> VerificationResult

    VerificationResult::to_text

    source
    fn VerificationResult::to_text(self : VerificationResult) -> String

    VerificationStatus

    source
    pub(all) enum VerificationStatus {
      Accepted
      Rejected
      Skipped
    } derive(Eq, 
    Debug    )

    WebhookRequest

    source
    pub struct WebhookRequest {
      provider : String
      http_method : HttpMethod
      path : String
      body : String
      headers : Array[Header]
      received_at : Int
      remote_ip : String
    } derive(Eq, 
    Debug    )

    WebhookRequest::event_id

    source
    fn WebhookRequest::event_id(self : WebhookRequest, header_name : String) -> String

    WebhookRequest::event_type

    source
    fn WebhookRequest::event_type(self : WebhookRequest, header_name : String) -> String

    WebhookRequest::header

    source
    fn WebhookRequest::header(self : WebhookRequest, name : String) -> String?

    WebhookRequest::new

    source
    fn WebhookRequest::new(provider : String, http_method : HttpMethod, path : String, body : String, received_at : Int, headers? : Array[Header], remote_ip? : String) -> WebhookRequest

    WebhookRequest::signature

    source
    fn WebhookRequest::signature(self : WebhookRequest, header_name : String) -> String

    WebhookRequest::timestamp

    source
    fn WebhookRequest::timestamp(self : WebhookRequest, header_name : String) -> Int

    WebhookRequest::with_header

    source
    fn WebhookRequest::with_header(self : WebhookRequest, name : String, value : String) -> WebhookRequest

    WebhookRequest::with_replaced_header

    source
    fn WebhookRequest::with_replaced_header(self : WebhookRequest, name : String, value : String) -> WebhookRequest

    WebhookRequest::without_header

    source
    fn WebhookRequest::without_header(self : WebhookRequest, name : String) -> WebhookRequest

    WebhookResponse

    source
    pub struct WebhookResponse {
      status_code : Int
      body : String
      retryable : Bool
    } derive(Eq, 
    Debug    )

    WebhookResponse::new

    source
    fn WebhookResponse::new(status_code : Int, body : String, retryable : Bool) -> WebhookResponse

    abs_int

    source
    fn abs_int(value : Int) -> Int

    accepted_count

    source
    fn accepted_count(results : Array[VerificationResult]) -> Int

    accepted_response

    source
    fn accepted_response() -> WebhookResponse

    admission_rule_for

    source
    fn admission_rule_for(provider : String) -> AdmissionRule

    ascii_lower

    source
    fn ascii_lower(input : String) -> String

    audit_digest

    source
    fn audit_digest(previous : String, output : GuardPipelineOutput) -> String

    audit_log_markdown

    source
    fn audit_log_markdown(records : Array[AuditRecord]) -> String

    audit_record

    source
    fn audit_record(sequence : Int, previous_digest : String, output : GuardPipelineOutput) -> AuditRecord

    bad_signature_request

    source
    fn bad_signature_request() -> WebhookRequest

    bad_signature_scenario

    source
    fn bad_signature_scenario() -> Scenario

    base_github_request

    source
    fn base_github_request(body? : String) -> WebhookRequest

    batch_report_csv

    source
    fn batch_report_csv(report : BatchReport) -> String

    batch_report_markdown

    source
    fn batch_report_markdown(report : BatchReport) -> String

    batch_risk_scores

    source
    fn batch_risk_scores(results : Array[VerificationResult]) -> Array[RiskScore]

    build_audit_log

    source
    fn build_audit_log(outputs : Array[GuardPipelineOutput]) -> Array[AuditRecord]

    build_integration_guide

    source
    fn build_integration_guide(config : GuardConfig) -> IntegrationGuide

    canonical_base

    source
    fn canonical_base(request : WebhookRequest, profile : ProviderProfile) -> String

    canonical_body

    source
    fn canonical_body(request : WebhookRequest) -> String

    canonical_debug_lines

    source
    fn canonical_debug_lines(request : WebhookRequest, profile : ProviderProfile) -> Array[String]

    canonical_debug_text

    source
    fn canonical_debug_text(request : WebhookRequest, profile : ProviderProfile) -> String

    canonical_event

    source
    fn canonical_event(request : WebhookRequest, profile : ProviderProfile) -> String

    canonical_id

    source
    fn canonical_id(request : WebhookRequest, profile : ProviderProfile) -> String

    canonical_timestamp

    source
    fn canonical_timestamp(request : WebhookRequest, profile : ProviderProfile) -> String

    capabilities_catalog

    source
    fn capabilities_catalog() -> Array[ProviderCapabilities]

    capability_for

    source
    fn capability_for(name : String) -> ProviderCapabilities

    categorize

    source
    fn categorize(code : DiagnosticCode) -> ErrorCategory

    category_name

    source
    fn category_name(category : ErrorCategory) -> String

    check_admission

    source
    fn check_admission(provider : String, now : Int, rule : AdmissionRule, state : AdmissionState) -> AdmissionDecision

    clone_with_body

    source
    fn clone_with_body(request : WebhookRequest, body : String) -> WebhookRequest

    clone_with_received_at

    source
    fn clone_with_received_at(request : WebhookRequest, received_at : Int) -> WebhookRequest

    combined_cookbook

    source
    fn combined_cookbook() -> String

    config_summary

    source
    fn config_summary(config : GuardConfig) -> String

    constant_time_equal

    source
    fn constant_time_equal(left : String, right : String) -> Bool

    contains_string

    source
    fn contains_string(items : Array[String], value : String) -> Bool

    cookbook_for

    source
    fn cookbook_for(provider : String) -> String

    debug_snapshot

    source
    fn debug_snapshot(request : WebhookRequest, policy : VerificationPolicy) -> DebugSnapshot

    debug_snapshot_text

    source
    fn debug_snapshot_text(snapshot : DebugSnapshot) -> String

    default_admission_rules

    source
    fn default_admission_rules() -> Array[AdmissionRule]

    default_integration_guide

    source
    fn default_integration_guide() -> String

    default_manifest

    source
    fn default_manifest(config : GuardConfig) -> GuardManifest

    default_router

    source
    fn default_router() -> EventRouter

    describe_provider

    source
    fn describe_provider(provider_name : String) -> String

    diagnostic_name

    source
    fn diagnostic_name(code : DiagnosticCode) -> String

    diagnostic_to_help

    source
    fn diagnostic_to_help(diagnostic : GuardDiagnostic) -> String

    dispatch_request

    source
    fn dispatch_request(request : WebhookRequest, policy : VerificationPolicy, router : EventRouter) -> DispatchOutcome

    dispatch_text

    source
    fn dispatch_text(outcome : DispatchOutcome) -> String

    duplicate_groups

    source
    fn duplicate_groups(results : Array[VerificationResult]) -> Array[DuplicateGroup]

    duplicate_report

    source
    fn duplicate_report(groups : Array[DuplicateGroup]) -> String

    endpoint_catalog_markdown

    source
    fn endpoint_catalog_markdown(router : EventRouter) -> String

    endpoint_for_profile

    source
    fn endpoint_for_profile(profile : ProviderProfile, path : String) -> EndpointSpec

    endpoint_from_router

    source
    fn endpoint_from_router(profile : ProviderProfile, router : EventRouter, path : String) -> EndpointSpec

    endpoint_markdown

    source
    fn endpoint_markdown(spec : EndpointSpec) -> String

    evaluate_guard_config

    source
    fn evaluate_guard_config(policy : VerificationPolicy, router : EventRouter) -> GuardQualityReport

    example_github_request

    source
    fn example_github_request() -> WebhookRequest

    expected_signature

    source
    fn expected_signature(request : WebhookRequest, policy : VerificationPolicy) -> String

    expired_request

    source
    fn expired_request() -> WebhookRequest

    expired_scenario

    source
    fn expired_scenario() -> Scenario

    explain_risk

    source
    fn explain_risk(score : RiskScore) -> String

    explain_verification

    source
    fn explain_verification(request : WebhookRequest, policy : VerificationPolicy) -> String

    feishu_capabilities

    source
    fn feishu_capabilities() -> ProviderCapabilities

    feishu_cookbook

    source
    fn feishu_cookbook() -> String

    feishu_message_scenario

    source
    fn feishu_message_scenario() -> Scenario

    feishu_message_schema

    source
    fn feishu_message_schema() -> PayloadSchema

    feishu_request

    source
    fn feishu_request() -> WebhookRequest

    find_provider

    source
    fn find_provider(name : String) -> ProviderProfile

    first_signature_value

    source
    fn first_signature_value(components : Array[SignatureComponent], key : String) -> String?

    generic_capabilities

    source
    fn generic_capabilities() -> ProviderCapabilities

    github_capabilities

    source
    fn github_capabilities() -> ProviderCapabilities

    github_cookbook

    source
    fn github_cookbook() -> String

    github_issue_schema

    source
    fn github_issue_schema() -> PayloadSchema

    has_category

    source
    fn has_category(result : VerificationResult, category : ErrorCategory) -> Bool

    headers_to_text

    source
    fn headers_to_text(headers : Array[Header]) -> String

    hmac_sha256_hex

    source
    fn hmac_sha256_hex(secret : String, message : String) -> String

    idempotency_key

    source
    fn idempotency_key(request : WebhookRequest, policy : VerificationPolicy) -> String

    ignored_response

    source
    fn ignored_response(reason : String) -> WebhookResponse

    integration_guide_markdown

    source
    fn integration_guide_markdown(guide : IntegrationGuide) -> String

    integration_summary

    source
    fn integration_summary(config : GuardConfig) -> String

    join_lines

    source
    fn join_lines(lines : Array[String]) -> String

    json_path_text

    source
    fn json_path_text(json : Json, path : Array[String]) -> String?

    json_path_value

    source
    fn json_path_value(json : Json, path : Array[String]) -> Json?

    manifest_json_like

    source
    fn manifest_json_like(manifest : GuardManifest) -> String

    manifest_markdown

    source
    fn manifest_markdown(manifest : GuardManifest) -> String

    mask_secret

    source
    fn mask_secret(secret : String) -> String

    max_risk

    source
    fn max_risk(scores : Array[RiskScore]) -> RiskScore

    method_name

    source
    fn method_name(http_method : HttpMethod) -> String

    normalize_provider_request

    source
    fn normalize_provider_request(request : WebhookRequest, provider_name : String) -> WebhookRequest

    package_name

    source
    fn package_name() -> String

    parse_headers

    source
    fn parse_headers(text : String) -> Array[Header]

    parse_method

    source
    fn parse_method(value : String) -> HttpMethod

    parse_payload_document

    source
    fn parse_payload_document(body : String) -> PayloadDocument

    parse_payload_fields

    source
    fn parse_payload_fields(body : String) -> Array[PayloadField]

    parse_positive_int

    source
    fn parse_positive_int(input : String) -> Int

    parse_signature_header

    source
    fn parse_signature_header(input : String) -> Array[SignatureComponent]

    parse_stripe_signature

    source
    fn parse_stripe_signature(input : String) -> StripeSignature

    payload_contains_path

    source
    fn payload_contains_path(body : String, path : Array[String]) -> Bool

    payload_document_summary

    source
    fn payload_document_summary(document : PayloadDocument) -> String

    payload_error_text

    source
    fn payload_error_text(errors : Array[PayloadValidationError]) -> String

    payload_first_path

    source
    fn payload_first_path(body : String, paths : Array[Array[String]]) -> String?

    payload_has_key

    source
    fn payload_has_key(fields : Array[PayloadField], key : String) -> Bool

    payload_is_valid_json

    source
    fn payload_is_valid_json(body : String) -> Bool

    payload_keys

    source
    fn payload_keys(body : String) -> Array[String]

    payload_path_text

    source
    fn payload_path_text(body : String, path : Array[String]) -> String?

    payload_summary

    source
    fn payload_summary(fields : Array[PayloadField]) -> String

    payload_value

    source
    fn payload_value(fields : Array[PayloadField], key : String) -> String?

    pipeline_batch_text

    source
    fn pipeline_batch_text(outputs : Array[GuardPipelineOutput]) -> String

    pipeline_output_text

    source
    fn pipeline_output_text(output : GuardPipelineOutput) -> String

    plan_for_output

    source
    fn plan_for_output(output : GuardPipelineOutput) -> HandlingPlan

    plan_text

    source
    fn plan_text(plan : HandlingPlan) -> String

    plans_for_outputs

    source
    fn plans_for_outputs(outputs : Array[GuardPipelineOutput]) -> Array[HandlingPlan]

    policy_for_provider

    source
    fn policy_for_provider(provider_name : String, secret : String, now : Int) -> VerificationPolicy

    provider_catalog

    source
    fn provider_catalog() -> Array[ProviderProfile]

    provider_event_id

    source
    fn provider_event_id(request : WebhookRequest, profile : ProviderProfile) -> String

    provider_event_type

    source
    fn provider_event_type(request : WebhookRequest, profile : ProviderProfile) -> String

    provider_markdown_table

    source
    fn provider_markdown_table() -> String

    provider_metadata

    source
    fn provider_metadata(request : WebhookRequest, profile : ProviderProfile) -> ProviderRequestMetadata

    provider_metadata_is_complete

    source
    fn provider_metadata_is_complete(metadata : ProviderRequestMetadata, require_timestamp : Bool, require_event_id : Bool) -> Bool

    provider_metadata_text

    source
    fn provider_metadata_text(metadata : ProviderRequestMetadata) -> String

    provider_nonce

    source
    fn provider_nonce(request : WebhookRequest, profile : ProviderProfile) -> String

    provider_signature_algorithm

    source
    fn provider_signature_algorithm(profile : ProviderProfile) -> String

    provider_timestamp

    source
    fn provider_timestamp(request : WebhookRequest, profile : ProviderProfile) -> Int

    provider_timestamp_text

    source
    fn provider_timestamp_text(request : WebhookRequest, profile : ProviderProfile) -> String

    quality_text

    source
    fn quality_text(report : GuardQualityReport) -> String

    raw_request_summary

    source
    fn raw_request_summary(request : WebhookRequest, profile : ProviderProfile) -> String

    receive_batch

    source
    fn receive_batch(requests : Array[WebhookRequest], config : ReceiverConfig) -> Array[ReceiverOutput]

    receive_webhook

    source
    fn receive_webhook(request : WebhookRequest, config : ReceiverConfig, state : ReceiverState) -> ReceiverOutput

    receiver_batch_report

    source
    fn receiver_batch_report(outputs : Array[ReceiverOutput]) -> String

    receiver_output_text

    source
    fn receiver_output_text(output : ReceiverOutput) -> String

    rejected_count

    source
    fn rejected_count(results : Array[VerificationResult]) -> Int

    rejected_response

    source
    fn rejected_response(reason : String) -> WebhookResponse

    remediation

    source
    fn remediation(code : DiagnosticCode) -> String

    replay_key

    source
    fn replay_key(request : WebhookRequest, policy : VerificationPolicy) -> String

    request_from_parts

    source
    fn request_from_parts(provider : String, method_text : String, path : String, body : String, received_at : Int, header_text : String) -> WebhookRequest

    response_for_output

    source
    fn response_for_output(output : GuardPipelineOutput) -> WebhookResponse

    response_text

    source
    fn response_text(response : WebhookResponse) -> String

    result_help

    source
    fn result_help(result : VerificationResult) -> String

    result_to_markdown

    source
    fn result_to_markdown(result : VerificationResult) -> String

    retry_response

    source
    fn retry_response(reason : String) -> WebhookResponse

    risk_table

    source
    fn risk_table(scores : Array[RiskScore]) -> String

    route_demo_events

    source
    fn route_demo_events() -> String

    run_guard_pipeline

    source
    fn run_guard_pipeline(request : WebhookRequest, config : GuardConfig) -> GuardPipelineOutput

    run_scenario

    source
    fn run_scenario(scenario : Scenario, config : GuardConfig) -> ScenarioResult

    run_scenarios

    source
    fn run_scenarios(scenarios : Array[Scenario], config : GuardConfig) -> Array[ScenarioResult]

    run_stateful_batch

    source
    fn run_stateful_batch(requests : Array[WebhookRequest], config : GuardConfig) -> Array[GuardPipelineOutput]

    sample_requests

    source
    fn sample_requests() -> Array[WebhookRequest]

    scenario_pass_count

    source
    fn scenario_pass_count(results : Array[ScenarioResult]) -> Int

    scenario_report

    source
    fn scenario_report(results : Array[ScenarioResult]) -> String

    scenario_suite

    source
    fn scenario_suite() -> Array[Scenario]

    schema_for_event

    source
    fn schema_for_event(provider : String, event_type : String) -> PayloadSchema?

    schema_is_valid

    source
    fn schema_is_valid(schema : PayloadSchema, body : String) -> Bool

    score_result

    source
    fn score_result(result : VerificationResult) -> RiskScore

    sha256_hex

    source
    fn sha256_hex(message : String) -> String

    sign_request

    source
    fn sign_request(request : WebhookRequest, policy : VerificationPolicy) -> WebhookRequest

    signature_values

    source
    fn signature_values(components : Array[SignatureComponent], key : String) -> Array[String]

    signature_without_prefix

    source
    fn signature_without_prefix(signature : String, prefix : String) -> String

    stable_sign

    source
    fn stable_sign(secret : String, canonical : String) -> StableSignature

    Compatibility helper for deterministic audit and idempotency digests.

    starts_with

    source
    fn starts_with(input : String, prefix : String) -> Bool

    strip_prefix

    source
    fn strip_prefix(input : String, prefix : String) -> String

    stripe_capabilities

    source
    fn stripe_capabilities() -> ProviderCapabilities

    stripe_cookbook

    source
    fn stripe_cookbook() -> String

    stripe_request

    source
    fn stripe_request() -> WebhookRequest

    stripe_signature_summary

    source
    fn stripe_signature_summary(signature : StripeSignature) -> String

    summarize_results

    source
    fn summarize_results(results : Array[VerificationResult]) -> String

    trim_ascii

    source
    fn trim_ascii(input : String) -> String

    valid_github_issue_scenario

    source
    fn valid_github_issue_scenario() -> Scenario

    validate_config

    source
    fn validate_config(config : GuardConfig) -> GuardQualityReport

    validate_payload_schema

    source
    fn validate_payload_schema(schema : PayloadSchema, fields : Array[PayloadField]) -> Array[PayloadValidationError]

    validate_request_payload

    source
    fn validate_request_payload(request : WebhookRequest, profile : ProviderProfile) -> Array[PayloadValidationError]

    verify_audit_chain

    source
    fn verify_audit_chain(records : Array[AuditRecord], outputs : Array[GuardPipelineOutput]) -> Bool

    verify_batch

    source
    fn verify_batch(requests : Array[WebhookRequest], policy : VerificationPolicy) -> Array[VerificationResult]

    verify_batch_report

    source
    fn verify_batch_report(requests : Array[WebhookRequest], policy : VerificationPolicy) -> BatchReport

    verify_request

    source
    fn verify_request(request : WebhookRequest, policy : VerificationPolicy) -> VerificationResult

    verify_request_with_state

    source
    fn verify_request_with_state(request : WebhookRequest, policy : VerificationPolicy, state : GuardState) -> (VerificationResult, GuardState)

    verify_signature

    source
    fn verify_signature(request : WebhookRequest, policy : VerificationPolicy) -> Bool

    version

    source
    fn version() -> String

    Source Files

    Powered by MoonBit

    Site sourceReport issueModulesSkillsCLIBuild queueStatistics

    © 2026 mooncakes.io