Changed Webhook Auth Logic

README.md

@@ -31,7 +31,7 @@ SmoothCodeAuth(request_hmac, client_secret).is_dashboard_request(shop) # returns
 from smoothcode_auth import SmoothCodeAuth
 
 # SmoothCode sends hmac in the Authorization Header of the request
-# It is hmac of the webhook data signed by your App Client Secret
+# It is hmac of the webhook id signed by your App Client Secret
 
 SmoothCodeAuth(request_hmac, client_secret).is_webhook_request(webhook_data) # returns True if the request is valid
 ```

smoothcode_auth/__init__.py

@@ -4,4 +4,4 @@
 
 from .auth import SmoothCodeAuth
 
-__version__ = '0.0.2'
+__version__ = '0.0.3'

smoothcode_auth/auth.py

@@ -12,5 +12,5 @@ def is_dashboard_request(self, shop: str):
         return generate_hmac(self.client_secret, shop) == self.hmac
 
     def is_webhook_request(self, webhook_data: dict):
-        stringfied_webhook_data = json.dumps(webhook_data, separators=(',', ':'))
-        return generate_hmac(self.client_secret, stringfied_webhook_data) == self.hmac
+        webhook_id = webhook_data.get('id')
+        return generate_hmac(self.client_secret, str(webhook_id)) == self.hmac

tests/test_auth.py

@@ -14,10 +14,10 @@ def test_is_dashboard_request_with_incorrect_data(self):
 
     def test_is_webhook_request_with_correct_data(self):
         client_secret = 'client_secret'
-        request_hmac = '656718377faf656ccc037d8607ebfe3434197981aa1362db81210252ce92cd5c'
-        assert SmoothCodeAuth(request_hmac, client_secret).is_webhook_request({'request': 'webhook'})
+        request_hmac = '3999c5c10e23bee670e28ad67f446ac5e7b9c47ca1ee39c4bdf0c7bf056f8d71'
+        assert SmoothCodeAuth(request_hmac, client_secret).is_webhook_request({'id': 1235643534})
 
     def test_is_webhook_request_with_incorrect_data(self):
         client_secret = 'client_secret'
         request_hmac = 'request_hmac'
-        assert not SmoothCodeAuth(request_hmac, client_secret).is_webhook_request({'request': 'webhook'})
+        assert not SmoothCodeAuth(request_hmac, client_secret).is_webhook_request({'id': 'webhook'})