Lay the HubSpot and customer-lifecycle foundation

Work in progress from the Codex session, committed so nothing sits undeployed. Verified before committing: typecheck clean across all packages, 139 unit tests and the e2e suite green, migrations apply to an empty Postgres. Adds the HubSpot integration boundary (OAuth, client, contracts, webhook signature verification, sync), a growth route, customer-lifecycle service, Piggy lifecycle tools, a Growth page, and shared lifecycle/hubspot types. Two things are deliberately incomplete and should not be mistaken for finished: `packages/db/src/schema/hubspot.ts` is NOT exported from the schema index, so it is inert — no tables, no migration. That is the correct order (the shape can settle before it becomes a migration), but it does mean the HubSpot routes have no persistence behind them yet. `pnpm-workspace.yaml` and `pnpm-lock.yaml` are left uncommitted on purpose. The workspace file contains a literal unanswered placeholder — "esbuild: set this to true or false" — and this repository installs with npm, which is also what CI runs. Committing a second package manager's lockfile would make the install ambiguous. If the move to pnpm is intended it should be a deliberate change that updates CI and the Dockerfile together. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-13 03:50:18 -07:00
parent d4d7095605
commit 74e37f3e76
20 changed files with 2180 additions and 0 deletions
@@ -0,0 +1,63 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+
+const SIGNATURE_MAX_AGE_MS = 5 * 60 * 1_000;
+const HUBSPOT_URI_DECODE_PATTERN = /%3A|%2F|%3F|%40|%21|%24|%27|%28|%29|%2A|%2C|%3B/gi;
+const HUBSPOT_URI_DECODINGS: Record<string, string> = {
+  '%3A': ':',
+  '%2F': '/',
+  '%3F': '?',
+  '%40': '@',
+  '%21': '!',
+  '%24': '$',
+  '%27': "'",
+  '%28': '(',
+  '%29': ')',
+  '%2A': '*',
+  '%2C': ',',
+  '%3B': ';',
+};
+
+export interface HubSpotV3SignatureInput {
+  clientSecret: string;
+  method: string;
+  publicUri: string;
+  rawBody: string;
+  signature: string | undefined;
+  timestamp: string | undefined;
+  now?: Date;
+}
+
+export type HubSpotSignatureResult =
+  | { valid: true }
+  | { valid: false; reason: 'missing_headers' | 'invalid_timestamp' | 'stale_timestamp' | 'mismatch' };
+
+export function normalizeHubSpotSignatureUri(uri: string): string {
+  const withoutFragment = uri.split('#', 1)[0] ?? uri;
+  const queryIndex = withoutFragment.indexOf('?');
+  if (queryIndex < 0) return withoutFragment;
+  const prefix = withoutFragment.slice(0, queryIndex + 1);
+  const query = withoutFragment.slice(queryIndex + 1).replace(
+    HUBSPOT_URI_DECODE_PATTERN,
+    (encoded) => HUBSPOT_URI_DECODINGS[encoded.toUpperCase()] ?? encoded,
+  );
+  return prefix + query;
+}
+
+export function verifyHubSpotV3Signature(input: HubSpotV3SignatureInput): HubSpotSignatureResult {
+  if (!input.signature || !input.timestamp) return { valid: false, reason: 'missing_headers' };
+  if (!/^\d+$/.test(input.timestamp)) return { valid: false, reason: 'invalid_timestamp' };
+  const timestamp = Number(input.timestamp);
+  if (!Number.isSafeInteger(timestamp)) return { valid: false, reason: 'invalid_timestamp' };
+  const now = input.now ?? new Date();
+  if (Math.abs(now.getTime() - timestamp) > SIGNATURE_MAX_AGE_MS) {
+    return { valid: false, reason: 'stale_timestamp' };
+  }
+  const source = `${input.method}${normalizeHubSpotSignatureUri(input.publicUri)}${input.rawBody}${input.timestamp}`;
+  const expected = createHmac('sha256', input.clientSecret).update(source, 'utf8').digest('base64');
+  const expectedBytes = Buffer.from(expected, 'utf8');
+  const suppliedBytes = Buffer.from(input.signature, 'utf8');
+  if (expectedBytes.length !== suppliedBytes.length) return { valid: false, reason: 'mismatch' };
+  return timingSafeEqual(expectedBytes, suppliedBytes)
+    ? { valid: true }
+    : { valid: false, reason: 'mismatch' };
+}