feat(typescript): compile-time missing secret error

Author: jablko

src/index.ts

@@ -9,7 +9,6 @@ import {
   EmitterWebhookEventName,
   HandlerFunction,
   Options,
-  State,
   WebhookError,
   WebhookEventHandlerError,
 } from "./types";
@@ -42,12 +41,12 @@ class Webhooks<
     options: EmitterWebhookEvent & { signature: string }
   ) => Promise<void>;
 
-  constructor(options?: Options<E, TTransformed>) {
+  constructor(options?: Options<E, TTransformed> & { secret: string }) {
     if (!options || !options.secret) {
       throw new Error("[@octokit/webhooks] options.secret required");
     }
 
-    const state: State = {
+    const state = {
       eventHandler: createEventHandler(options),
       path: options.path || "/",
       secret: options.secret,

src/middleware/index.ts

@@ -1,13 +1,13 @@
 import { createEventHandler } from "../event-handler/index";
 import { middleware } from "./middleware";
-import { Options, State } from "../types";
+import { Options } from "../types";
 
-export function createMiddleware(options: Options<any>) {
+export function createMiddleware(options: Options<any> & { secret: string }) {
   if (!options || !options.secret) {
     throw new Error("[@octokit/webhooks] options.secret required");
   }
 
-  const state: State = {
+  const state = {
     eventHandler: createEventHandler(options),
     path: options.path || "/",
     secret: options.secret,

src/middleware/middleware.ts

@@ -10,7 +10,7 @@ import { State, WebhookEventHandlerError } from "../types";
 const debugWebhooks = debug("webhooks:receiver");
 
 export function middleware(
-  state: State,
+  state: State & { secret: string },
   request: IncomingMessage,
   response: ServerResponse,
   next?: Function

src/middleware/verify-and-receive.ts

@@ -2,15 +2,11 @@ import { EmitterWebhookEvent, State } from "../types";
 import { verify } from "../verify/index";
 
 export function verifyAndReceive(
-  state: State,
+  state: State & { secret: string },
   event: EmitterWebhookEvent & { signature: string }
 ): any {
   // verify will validate that the secret is not undefined
-  const matchesSignature = verify(
-    state.secret!,
-    event.payload,
-    event.signature
-  );
+  const matchesSignature = verify(state.secret, event.payload, event.signature);
 
   if (!matchesSignature) {
     const error = new Error(

test/unit/middleware-constructor-test.ts

@@ -1,5 +1,6 @@
 import { createMiddleware as Middleware } from "../../src/middleware";
 
 test("options: none", () => {
+  // @ts-expect-error
   expect(() => Middleware({})).toThrow();
 });

test/unit/middleware-test.ts

@@ -17,6 +17,7 @@ test("next() callback", () => {
 
   middleware(
     {
+      secret: "mysecret",
       hooks: {},
     },
     { method: "POST", url: "/foo" } as IncomingMessage,
@@ -41,7 +42,7 @@ describe("when does a timeout on retrieving the payload", () => {
     mockVerifyAndReceive.mockResolvedValueOnce(undefined);
 
     const promiseMiddleware = middleware(
-      { hooks: {}, path: "/foo" },
+      { secret: "mysecret", hooks: {}, path: "/foo" },
       {
         method: "POST",
         url: "/foo",
@@ -70,7 +71,7 @@ describe("when does a timeout on retrieving the payload", () => {
     mockVerifyAndReceive.mockRejectedValueOnce(new Error("random error"));
 
     const promiseMiddleware = middleware(
-      { hooks: {}, path: "/foo" },
+      { secret: "mysecret", hooks: {}, path: "/foo" },
       {
         method: "POST",
         url: "/foo",