Switch to using @farcaster/frame-node for webhook parsing & validation

src/app/api/webhook/route.ts

@@ -1,6 +1,9 @@
-import { eventPayloadSchema } from "@farcaster/frame-sdk";
+import {
+  ParseWebhookEvent,
+  parseWebhookEvent,
+  verifyAppKeyWithNeynar,
+} from "@farcaster/frame-node";
 import { NextRequest } from "next/server";
-import { verifyJsonFarcasterSignature } from "~/lib/jfs";
 import {
   deleteUserNotificationDetails,
   setUserNotificationDetails,
@@ -12,38 +15,40 @@ export async function POST(request: NextRequest) {
 
   let data;
   try {
-    const verifySignatureResult = await verifyJsonFarcasterSignature(
-      requestJson
-    );
-    if (verifySignatureResult.success === false) {
-      return Response.json(
-        { success: false, error: verifySignatureResult.error },
-        { status: 401 }
-      );
-    }
+    data = await parseWebhookEvent(requestJson, verifyAppKeyWithNeynar);
+  } catch (e: unknown) {
+    const error = e as ParseWebhookEvent.ErrorType;
 
-    data = verifySignatureResult;
-  } catch {
-    return Response.json({ success: false }, { status: 500 });
+    switch (error.name) {
+      case "VerifyJsonFarcasterSignature.InvalidDataError":
+      case "VerifyJsonFarcasterSignature.InvalidEventDataError":
+        // The request data is invalid
+        return Response.json(
+          { success: false, error: error.message },
+          { status: 400 }
+        );
+      case "VerifyJsonFarcasterSignature.InvalidAppKeyError":
+        // The app key is invalid
+        return Response.json(
+          { success: false, error: error.message },
+          { status: 401 }
+        );
+      case "VerifyJsonFarcasterSignature.VerifyAppKeyError":
+        // Internal error verifying the app key (caller may want to try again)
+        return Response.json(
+          { success: false, error: error.message },
+          { status: 500 }
+        );
+    }
   }
 
   const fid = data.fid;
-  const payloadData = JSON.parse(
-    Buffer.from(data.payload, "base64url").toString("utf-8")
-  );
-  const payload = eventPayloadSchema.safeParse(payloadData);
+  const event = data.event;
 
-  if (payload.success === false) {
-    return Response.json(
-      { success: false, errors: payload.error.errors },
-      { status: 400 }
-    );
-  }
-
-  switch (payload.data.event) {
+  switch (event.event) {
     case "frame_added":
-      if (payload.data.notificationDetails) {
-        await setUserNotificationDetails(fid, payload.data.notificationDetails);
+      if (event.notificationDetails) {
+        await setUserNotificationDetails(fid, event.notificationDetails);
         await sendFrameNotification({
           fid,
           title: "Welcome to Frames v2",
@@ -59,7 +64,7 @@ export async function POST(request: NextRequest) {
 
       break;
     case "notifications_enabled":
-      await setUserNotificationDetails(fid, payload.data.notificationDetails);
+      await setUserNotificationDetails(fid, event.notificationDetails);
       await sendFrameNotification({
         fid,
         title: "Ding ding ding",

src/lib/jfs.ts

@@ -1,62 +0,0 @@
-import { ed25519 } from "@noble/curves/ed25519";
-import {
-  encodedJsonFarcasterSignatureSchema,
-  jsonFarcasterSignatureHeaderSchema,
-} from "@farcaster/frame-sdk";
-import { isSignerValid } from "~/lib/neynar";
-
-type VerifyJsonFarcasterSignatureResult =
-  | { success: false; error: unknown }
-  | { success: true; fid: number; payload: string };
-
-export async function verifyJsonFarcasterSignature(
-  data: unknown
-): Promise<VerifyJsonFarcasterSignatureResult> {
-  // Parse & decode
-  const body = encodedJsonFarcasterSignatureSchema.safeParse(data);
-  if (body.success === false) {
-    return { success: false, error: body.error.errors };
-  }
-
-  const headerData = JSON.parse(
-    Buffer.from(body.data.header, "base64url").toString("utf-8")
-  );
-  const header = jsonFarcasterSignatureHeaderSchema.safeParse(headerData);
-  if (header.success === false) {
-    return { success: false, error: header.error.errors };
-  }
-
-  const signature = Buffer.from(body.data.signature, "base64url");
-  if (signature.byteLength !== 64) {
-    return { success: false, error: "Invalid signature length" };
-  }
-
-  const fid = header.data.fid;
-  const key = header.data.key;
-
-  // Verify that the signer belongs to the FID
-  try {
-    const validSigner = await isSignerValid({
-      fid,
-      signerPublicKey: key,
-    });
-    if (!validSigner) {
-      return { success: false, error: "Invalid signer" };
-    }
-  } catch {
-    return { success: false, error: "Error verifying signer" };
-  }
-
-  const signedInput = new Uint8Array(
-    Buffer.from(body.data.header + "." + body.data.payload)
-  );
-
-  const keyBytes = Uint8Array.from(Buffer.from(key.slice(2), "hex"));
-
-  const verifyResult = ed25519.verify(signature, signedInput, keyBytes);
-  if (!verifyResult) {
-    return { success: false, error: "Invalid signature" };
-  }
-
-  return { success: true, fid, payload: body.data.payload };
-}

src/lib/neynar.ts

@@ -1,34 +0,0 @@
-const apiKey = process.env.NEYNAR_API_KEY || "";
-
-export async function isSignerValid({
-  fid,
-  signerPublicKey,
-}: {
-  fid: number;
-  signerPublicKey: string;
-}): Promise<boolean> {
-  const url = new URL("https://hub-api.neynar.com/v1/onChainSignersByFid");
-  url.searchParams.append("fid", fid.toString());
-
-  const response = await fetch(url, {
-    method: "GET",
-    headers: {
-      "x-api-key": apiKey,
-    },
-  });
-
-  if (response.status !== 200) {
-    throw new Error(await response.text());
-  }
-
-  const responseJson = await response.json();
-  const signerPublicKeyLC = signerPublicKey.toLowerCase();
-
-  const signerExists = responseJson.events.find(
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    (event: any) =>
-      event.signerEventBody.key.toLowerCase() === signerPublicKeyLC
-  );
-
-  return signerExists;
-}