[{"_1":2,"_307":-5,"_308":-5},"loaderData",{"_3":4,"_93":94,"_255":256},"root",{"_5":6,"_36":37,"_66":67},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":22,"_29":22,"_30":22,"_31":-5,"_32":33,"_34":22,"_35":22},"auth",{"_9":10,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":-5,"_20":-5,"_21":22},"tokenType","session_token","sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesChatPanelState","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63,"_64":65},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","807fcf9310514ac3300af510441b05f48071d6f0","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_68":69},"__internal_clerk_state",{"_70":71,"_72":47,"_73":74,"_75":74,"_76":22,"_77":74,"_78":74,"_79":74,"_80":74,"_81":82,"_91":22,"_92":22},"__clerk_ssr_state",{"_9":10,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":-5,"_20":-5,"_21":22},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_83":22,"_21":22,"_84":74,"_85":86,"_87":74,"_88":47,"_89":22,"_90":74},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/_app.x.$handle.$name",{"_95":96,"_97":98,"_99":45,"_100":101,"_102":-7,"_103":104,"_157":158,"_228":229,"_230":231,"_244":245,"_172":246,"_249":-5,"_250":-5,"_251":22,"_252":22,"_253":254},"handle","pwv","name","pwv-fund-application","branchName","path","test-webhook.ts","version","project",{"_105":106,"_97":98,"_107":108,"_109":-5,"_110":22,"_111":112,"_113":114,"_115":-5,"_14":116,"_117":118,"_119":120,"_121":120,"_122":-5,"_123":33,"_16":124,"_125":-5,"_126":-5,"_127":128,"_129":128,"_130":131,"_132":131,"_133":131,"_134":128,"_135":128,"_23":136,"_139":140,"_144":145,"_156":22},"id","ef3014d0-b35a-11f0-a9a4-0224a6c84d84","createdAt",["D",1761586358977],"deletedAt","legacyEnvVars","privacy","public","description","Handles PWV Fund form web hook","imageUrl","1167e096-63d9-481f-b740-997fcea83426","pinnedFileId","ef32c626-b35a-11f0-a9a4-0224a6c84d84","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","019b1364-b98b-7453-80e3-061dffc29aa9","tursoName","tursoHostname","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_95":96,"_137":138},"profileImageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/41a74c63-2836-497b-1c2b-22a793361400/square512","org",{"_95":96,"_141":138,"_14":-5,"_142":143},"avatar","tier","pro","branch",{"_102":146,"_97":45,"_105":147,"_148":106,"_149":-5,"_150":-5,"_151":-5,"_152":-5,"_153":-5,"_154":98,"_155":96},139,"ef307164-b35a-11f0-a9a4-0224a6c84d84","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","tree",[159,180,190,201,211,220],{"_105":160,"_97":161,"_162":163,"_164":-5,"_165":147,"_166":167,"_168":120,"_107":169,"_102":170,"_171":172,"_173":174,"_175":22,"_176":-5,"_177":178,"_100":179},"bf2485aa-df60-11f0-ab3e-42dde27851f2","PROMPT.txt","fileId","70d994d2-df5e-11f0-b570-42dde27851f2","parentId","branchId","branchVersion",126,"latest",["D",1766426706506],4,"fileType","file","content","You are an assistant to the general partners of VC fund: PWV, the Preston-Werner Ventures Fund.\n\nPWV invests in early‑stage technology companies.\n\nImportant notes:\n\n- PWV is Tom Preston‑Werner, David Price, and David Thyresson.\n- PWV is the fund we wanted as early-stage founders.\n- Ideas start with founders. Founders start with PWV.\n- We're an early-stage investment team with deep technical fluency,\nfounder-first values, and a track record of backing category-defining\ncompanies from zero to breakout.\n- You can learn about PWV, its portfolio, and team via: https://pwv.com/llms.txt\n\nI'm sending you data about a deal (founder contact info, company and website info, pitch deck link, and general message describing the company\nand it's your job to exhaustively research the company and person by visiting their links, finding their personal and company sites, \nblogs they've written, etc to determine if they are fit PWV's investment thesis.\n\nPWV's ideal investment will match:\n\n1. Preferred Stage\n2. Portfolio market segments\n3. Seed-stage (approximately)\n4. They know how to code\n\nReturn your final response in JSON only with the following schema:\n\n{\n \"founder_name\": string,\n \"founder_email\": string,\n \"company_name\": string,\n \"company_website\": string\n \"match\": boolean,\n \"reasoning\": string\n}","deleted","label","children",[],[161],{"_105":181,"_97":182,"_162":183,"_164":-5,"_165":147,"_166":184,"_168":120,"_107":185,"_102":186,"_171":172,"_173":187,"_175":22,"_176":-5,"_177":188,"_100":189},"e2f9f1d0-df5c-11f0-996d-42dde27851f2","README.md","6d598a88-df54-11f0-9e90-42dde27851f2",112,["D",1766425048640],15,"# PWV Fund Application Webhook\n\nA secure Netlify webhook handler for processing fund application form submissions. This webhook receives form submissions from Netlify Forms, verifies their authenticity, stores the data, and sends notifications via email and Slack.\n\n## Features\n\n- ✅ **Secure JWT Signature Verification** - Validates webhook authenticity using JWT (JWS) with HMAC-SHA256\n- ✅ **Data Storage** - Stores submissions in Val Town blob storage with deduplication\n- ✅ **Email Notifications** - Sends formatted emails to the fund team\n- ✅ **Slack Integration** - Posts notifications to Slack channels\n- ✅ **Comprehensive Error Handling** - Proper HTTP status codes and error responses\n- ✅ **Request Logging** - Detailed logging for debugging and monitoring\n- ✅ **Test Script** - Automated testing with signature generation\n\n## Security\n\n### JWT (JWS) Signature Verification\n\nThe webhook implements robust security by verifying Netlify's JWT (JSON Web Signature) for every incoming request. This ensures that only authentic requests from Netlify are processed.\n\n#### What is JWT/JWS?\n\nJWT (JSON Web Token) is a standard (RFC 7519) for securely transmitting information between parties as a digitally signed token. JWS (JSON Web Signature, RFC 7515) is the signature component that ensures the token hasn't been tampered with.\n\n**JWT Structure**: `header.payload.signature`\n- **Header**: Metadata about the token (algorithm: HS256, type: JWT)\n- **Payload**: The actual data (contains SHA-256 hash of request body and optional metadata)\n- **Signature**: Cryptographic signature created using HMAC-SHA256 and a shared secret key\n\n**Why JWT for Webhooks?**\n- **Tamper-proof**: Any modification to the body or headers invalidates the signature\n- **Verifiable**: Only parties with the shared secret can create valid signatures\n- **Standard**: Uses well-established cryptographic primitives (HMAC-SHA256)\n- **Efficient**: Verification is fast and doesn't require database lookups\n\n**Example JWT Token**:\n```\neyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaGEyNTYiOiJhYmMxMjMuLi4iLCJpYXQiOjE3MDM...signature...\n```\n\nYou can decode JWTs at [jwt.io](https://jwt.io) to inspect the header and payload (but signature verification requires the secret).\n\n#### How JWT Verification Works\n\n1. **Netlify Signs the Request**\n - When Netlify sends a webhook, it creates a JWT token\n - The JWT payload includes a SHA-256 hash of the request body\n - Netlify signs the JWT using your shared secret (`NETLIFY_FORM_JWS`)\n - The signed JWT is sent in the `x-webhook-signature` header\n\n2. **Webhook Verification Process**\n ```typescript\n // 1. Extract JWT from header\n const jwtToken = req.headers.get(\"x-webhook-signature\");\n \n // 2. Calculate SHA-256 hash of request body\n const bodyHash = await crypto.subtle.digest(\"SHA-256\", requestBody);\n const bodyHashHex = Array.from(new Uint8Array(bodyHash))\n .map(b => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n \n // 3. Decode JWT header and payload (without verifying yet)\n const [headerB64, payloadB64, signatureB64] = jwtToken.split(\".\");\n const payload = JSON.parse(atob(payloadB64));\n \n // 4. Compare body hash with hash in JWT payload\n if (payload.sha256 !== bodyHashHex) {\n return 401; // Body was tampered with\n }\n \n // 5. Import the shared secret as a cryptographic key\n const encoder = new TextEncoder();\n const keyData = encoder.encode(NETLIFY_FORM_JWS);\n const cryptoKey = await crypto.subtle.importKey(\n \"raw\",\n keyData,\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\", \"verify\"]\n );\n \n // 6. Verify JWT signature using shared secret\n const dataToVerify = encoder.encode(`${headerB64}.${payloadB64}`);\n const signatureBytes = base64UrlToArrayBuffer(signatureB64);\n \n const isValid = await crypto.subtle.verify(\n \"HMAC\",\n cryptoKey,\n signatureBytes,\n dataToVerify\n );\n \n if (!isValid) {\n return 401; // Invalid signature\n }\n ```\n\n3. **Security Guarantees**\n - **Authenticity**: Only requests signed with your secret are accepted\n - **Integrity**: Any tampering with the request body is detected via hash mismatch \n - **Non-repudiation**: The signature proves the request came from Netlify\n - **Replay Protection**: Combined with deduplication (checking submission ID), prevents replay attacks\n - **No Secrets Exposed**: The secret never leaves Netlify/Val Town servers\n\n#### Verification Steps\n\n| Step | Action | Security Check | What It Prevents |\n|------|--------|----------------|------------------|\n| 1 | Extract JWT from `x-webhook-signature` header | Header presence | Unsigned requests |\n| 2 | Calculate SHA-256 hash of request body | Body integrity | Modified payloads |\n| 3 | Decode JWT payload | JWT format validation | Malformed tokens |\n| 4 | Compare body hash with JWT payload hash | Payload matching | Tampered bodies |\n| 5 | Verify JWT signature with HMAC-SHA256 | Cryptographic verification | Forged signatures |\n\n### Error Responses\n\n| Status Code | Condition | Response |\n|-------------|-----------|----------|\n| `401 Unauthorized` | Invalid or missing signature | `{\"ok\": false, \"error\": \"Invalid signature\"}` |\n| `400 Bad Request` | Missing headers or unknown event | `{\"ok\": false}` |\n| `405 Method Not Allowed` | Non-POST requests | `\"PWV Deal Webhook - Method not allowed\"` |\n| `500 Internal Server Error` | Missing environment variables | `{\"ok\": false, \"error\": \"Server configuration error\"}` |\n\n## Configuration\n\n### Required Environment Variables\n\n```bash\n# Netlify webhook signing secret (JWS)\n# Find this in Netlify: Site Settings > Build & Deploy > Environment > Forms > Webhook secret\nNETLIFY_FORM_JWS=your_netlify_jws_secret\n\n# Slack webhook URL for notifications\nSLACK_WEBHOOK_URL=https://hooks.slack.com/services/...\n```\n\n### Netlify Form Setup\n\nThe webhook expects form submissions with the following fields:\n\n- `name` - Applicant's name\n- `email` - Applicant's email address (required)\n- `company` - Company name\n- `website` - Company website URL\n- `deck` - Link to pitch deck\n- `message` - Additional message/notes\n\n## Workflow\n\n### 1. Form Submission Processing\n\n```mermaid\ngraph TD\n A[Netlify Form Submitted] --> B[Webhook Receives POST]\n B --> C[Verify Headers Present]\n C --> D[Extract JWT Token]\n D --> E[Hash Request Body SHA-256]\n E --> F[Decode JWT Payload]\n F --> G[Compare Body Hash with JWT Hash]\n G --> H[Verify JWT Signature HMAC-SHA256]\n H --> I[Check Event Type]\n I --> J[Parse Form Data]\n J --> K[Validate Required Fields]\n K --> L[Check for Duplicates]\n L --> M[Store in Blob Storage]\n M --> N[Send Email Notification]\n N --> O[Send Slack Notification]\n O --> P[Return Success Response]\n```\n\n### 2. Data Storage\n\n- **Key Format**: `pwv-fund-submission-{submission_id}`\n- **Storage**: Val Town blob storage (JSON format)\n- **Deduplication**: Prevents duplicate processing of the same submission\n\n### 3. Notifications\n\n#### Email Notification\n- **Recipient**: `dt@prestonwernerventures.com`\n- **Subject**: `PWV Fund - New Submission - {company_name}`\n- **Format**: Structured text with all form fields and extracted domain\n\n#### Slack Notification\n- **Channel**: Configured via `SLACK_WEBHOOK_URL`\n- **Format**: Formatted message with submission details and edit link\n\n## API Reference\n\n### Endpoint\n\n```\nPOST /\n```\n\n### Headers\n\n| Header | Required | Description |\n|--------|----------|-------------|\n| `x-netlify-event` | Yes | Event type (must be \"submission_created\") |\n| `x-webhook-signature` | Yes | JWT token signed with HMAC-SHA256 |\n| `Content-Type` | Yes | application/json |\n\n### Request Body\n\n```json\n{\n \"id\": \"submission_unique_id\",\n \"number\": 95,\n \"data\": {\n \"name\": \"John Doe\",\n \"email\": \"john@example.com\",\n \"company\": \"Example Corp\",\n \"website\": \"https://example.com\",\n \"deck\": \"https://deck-link.com\",\n \"message\": \"We're building the future...\"\n },\n \"created_at\": \"2025-12-22T17:31:35.939Z\",\n \"site_name\": \"pwv-www\",\n \"form_name\": \"apply\"\n}\n```\n\n### Response Examples\n\n#### Success\n```json\n{\n \"ok\": true\n}\n```\n\n#### Duplicate Submission\n```json\n{\n \"ok\": true\n}\n```\n\n#### Invalid Signature\n```json\n{\n \"ok\": false,\n \"error\": \"Invalid signature\"\n}\n```\n\n## Development\n\n### Testing\n\n#### Automated Test Script\n\nThe `test-webhook.ts` file provides an automated way to test the webhook with proper JWT signature generation, mimicking exactly how Netlify signs and sends webhook requests.\n\n```typescript\n// Run the test script\nimport test from \"./test-webhook.ts\";\n```\n\n**What the test script does:**\n\n1. ✅ **Uses real sample data** from production form submissions\n2. ✅ **Calculates SHA-256 hash** of the request body (same as Netlify)\n3. ✅ **Creates JWT payload** with the body hash\n4. ✅ **Generates valid JWT token** signed with your `NETLIFY_FORM_JWS` secret using HMAC-SHA256\n5. ✅ **Includes all required headers**:\n - `Content-Type: application/json`\n - `x-netlify-event: submission_created`\n - `x-webhook-signature: `\n6. ✅ **Sends POST request** to the webhook endpoint\n7. ✅ **Displays detailed results** with status, body, and pass/fail indication\n\n**JWT Generation Process in Test Script:**\n\nThe test script replicates Netlify's exact JWT signing process:\n\n```typescript\n// 1. Hash the request body with SHA-256\n// This creates a fingerprint of the exact request body\nconst bodyBytes = new TextEncoder().encode(JSON.stringify(sampleData));\nconst hashBuffer = await crypto.subtle.digest(\"SHA-256\", bodyBytes);\nconst bodyHash = Array.from(new Uint8Array(hashBuffer))\n .map(b => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n// Result: \"a1b2c3...\" (64 hex characters)\n\n// 2. Create JWT header and payload\nconst header = { alg: \"HS256\", typ: \"JWT\" };\nconst payload = {\n iss: \"netlify\",\n sha256: bodyHash, // ⬅️ The body hash ensures integrity\n iat: Math.floor(Date.now() / 1000) // Optional: issued-at timestamp\n};\n\n// 3. Encode header and payload as base64url (not standard base64!)\n// base64url uses - and _ instead of + and /, with no padding\nconst headerB64 = base64UrlEncode(JSON.stringify(header));\nconst payloadB64 = base64UrlEncode(JSON.stringify(payload));\n\n// 4. Sign with HMAC-SHA256 using the shared secret\n// Import the secret as a cryptographic key\nconst cryptoKey = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(secret), // NETLIFY_FORM_JWS\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"]\n);\n\n// Create signature over \"header.payload\"\nconst signature = await crypto.subtle.sign(\n \"HMAC\",\n cryptoKey,\n new TextEncoder().encode(`${headerB64}.${payloadB64}`)\n);\n\n// 5. Encode signature and create final JWT token\nconst signatureB64 = base64UrlEncode(signature);\nconst jwtToken = `${headerB64}.${payloadB64}.${signatureB64}`;\n// Result: \"eyJ...header...eyJ...payload...sig...\"\n```\n\n**Key Points:**\n- Uses **base64url** encoding (not regular base64) for URL safety\n- Signature is created over `header.payload` (the first two parts)\n- HMAC-SHA256 ensures only parties with the secret can sign\n- The body hash in the payload links the JWT to the specific request body\n\n**Test Output Examples:**\n\n✅ **Successful Test (First Run):**\n```\n🧪 Testing PWV Fund Application Webhook\n============================================================\n\n🔑 JWT Token Generated:\n Header: {\"alg\":\"HS256\",\"typ\":\"JWT\"}\n Payload: {\"iss\":\"netlify\",\"sha256\":\"abc123...\",\"iat\":1703...}\n Signature: Valid HMAC-SHA256\n\n📤 Sending POST request to webhook endpoint...\n with x-netlify-event: submission_created\n with x-webhook-signature header (JWT)\n Body hash: abc123... (64 chars)\n\n📥 Response received:\n Status: 200\n Body: {\"ok\":true}\n\n✅ TEST PASSED: Webhook accepted the signed request\n ✓ JWT signature verified\n ✓ Body hash matched\n ✓ Submission processed\n ✓ Email sent\n ✓ Slack notified\n```\n\n✅ **Successful Test (Second Run - Duplicate):**\n```\n🧪 Testing PWV Fund Application Webhook\n============================================================\n\n📤 Sending POST request to webhook endpoint...\n\n📥 Response received:\n Status: 200\n Body: {\"ok\":true}\n\n✅ TEST PASSED: Webhook accepted the signed request\n ℹ️ Note: Duplicate submission detected (expected behavior)\n```\n\n❌ **Failed Test (Invalid Secret):**\n```\n🧪 Testing PWV Fund Application Webhook\n============================================================\n\n📤 Sending POST request to webhook endpoint...\n\n📥 Response received:\n Status: 401\n Body: {\"ok\":false,\"error\":\"Invalid signature\"}\n\n❌ TEST FAILED: Webhook rejected the request\n ✗ JWT signature verification failed\n → Check that NETLIFY_FORM_JWS matches Netlify settings\n```\n\n**Running the test:**\n- **Option 1**: Click \"Run\" button in the Val Town editor for `test-webhook.ts`\n- **Option 2**: Execute via module import in another val\n- **Option 3**: Test will automatically run when the file is loaded\n\n**Expected Results:**\n\n| Run | Expected Behavior | Status | Why |\n|-----|-------------------|--------|-----|\n| First run | Processes submission fully | ✅ 200 | New submission ID |\n| Second run | Detects duplicate, returns early | ✅ 200 | Duplicate detection works |\n| Wrong secret | Rejects with \"Invalid signature\" | ❌ 401 | HMAC verification fails |\n| Modified body after signing | Rejects with \"Invalid signature\" | ❌ 401 | Body hash mismatch detected |\n| Missing signature header | Rejects with error | ❌ 401 | Required header missing |\n| Wrong event type | Returns early | ⚠️ 400 | Not \"submission_created\" |\n\n**Important Notes:**\n- The test uses the same sample submission ID (`69498077f82665c79f3c0775`) each time\n- Second run will detect duplicate and return early (this is **expected behavior**)\n- To test multiple submissions, change the `id` field in the `sampleData` object\n- The test proves that your JWT verification is working correctly\n- Use this test after any changes to verify the webhook still works\n- Test generates authentic JWTs using the same algorithm (HMAC-SHA256) as Netlify\n- Safe to run repeatedly - duplicate detection prevents duplicate processing\n\n**Customizing Test Data:**\n\nTo test with different submissions, modify the `sampleData` object in `test-webhook.ts`:\n\n```typescript\nconst sampleData = {\n id: \"69498077f82665c79f3c0775\", // ⬅️ Change this for each unique test\n number: 95,\n data: {\n name: \"Your Name\",\n email: \"your@email.com\",\n company: \"Your Company\",\n website: \"https://example.com\",\n deck: \"https://deck-link.com\",\n message: \"Test message\"\n },\n created_at: new Date().toISOString(),\n // ... other fields\n};\n```\n\n**Pro Tip:** Generate unique IDs for testing:\n```typescript\nconst uniqueId = crypto.randomUUID().replace(/-/g, \"\").substring(0, 24);\n```\n\n#### Manual Testing with cURL\n\nFor manual testing, you need to generate a valid JWT signature:\n\n```bash\n# This won't work - signature needs to be properly generated\ncurl -X POST https://your-webhook-url.web.val.run \\\n -H \"Content-Type: application/json\" \\\n -H \"x-netlify-event: submission_created\" \\\n -H \"x-webhook-signature: \" \\\n -d '{\"id\":\"test\",\"data\":{...}}'\n```\n\n**Note**: Manual testing requires generating a valid JWT token. Use the `test-webhook.ts` script instead for accurate testing.\n\n#### Testing Without Signature (For Development)\n\nTo test the webhook logic without signature verification during development:\n\n1. Temporarily comment out the signature verification in `main.ts`\n2. Send requests without the `x-webhook-signature` header\n3. **Important**: Always re-enable signature verification before deploying\n\n### Monitoring\n\n- **Logs**: All requests and errors are logged with detailed context\n- **Request History**: Use Val Town's request history to debug issues\n- **Error Tracking**: Comprehensive error messages for troubleshooting\n- **Test Script**: Regular testing with `test-webhook.ts` to verify functionality\n\n## Deployment\n\n1. **Set Environment Variables**: Configure `NETLIFY_FORM_JWS` and `SLACK_WEBHOOK_URL`\n2. **Deploy to Val Town**: The webhook is automatically deployed as an HTTP endpoint\n3. **Configure Netlify**: \n - Navigate to Site Settings > Build & Deploy > Forms\n - Add your Val Town webhook URL\n - Generate and save the webhook secret to `NETLIFY_FORM_JWS`\n4. **Test**: Run `test-webhook.ts` to verify the integration\n\n## Security Considerations\n\n- **Secret Rotation**: Regularly rotate the `NETLIFY_FORM_JWS` secret\n - Generate new secret in Netlify\n - Update environment variable in Val Town\n - Update `test-webhook.ts` with new secret\n- **HTTPS Only**: Webhook only accepts HTTPS requests\n- **JWT Verification**: All requests must have valid JWT signatures\n- **Body Integrity**: SHA-256 hash verification prevents tampering\n- **Input Validation**: All form data is validated before processing\n- **Error Handling**: Sensitive information is not exposed in error messages\n\n## Troubleshooting\n\n### Common Issues\n\n1. **401 Unauthorized - Invalid signature**\n - **Cause**: JWT signature verification failed\n - **Solutions**:\n - Verify `NETLIFY_FORM_JWS` matches the secret in Netlify\n - Check that JWT token is correctly formatted\n - Ensure request body hasn't been modified\n - Run `test-webhook.ts` to verify your secret is correct\n\n2. **401 Unauthorized - Body hash mismatch**\n - **Cause**: Request body doesn't match the hash in JWT payload\n - **Solutions**:\n - Check for middleware modifying the request body\n - Ensure content encoding is correct\n - Verify no proxy is altering the request\n\n3. **Missing Headers**\n - **Cause**: Required headers not present\n - **Solutions**:\n - Ensure Netlify is configured to send webhooks\n - Check webhook configuration in Netlify settings\n - Verify event type is \"submission_created\"\n\n4. **500 Errors**\n - **Cause**: Missing environment variables\n - **Solutions**:\n - Verify `NETLIFY_FORM_JWS` is set\n - Verify `SLACK_WEBHOOK_URL` is set\n - Check Val Town environment variables\n\n5. **Email/Slack Failures**\n - **Cause**: Service configuration issues\n - **Solutions**:\n - Check respective service configurations\n - Verify credentials and permissions\n - Review service logs for specific errors\n\n### Debug Steps\n\n1. **Check Val Town request logs** for detailed error information\n2. **Run the test script** (`test-webhook.ts`) to isolate issues\n3. **Verify JWT signature** using online JWT decoder (jwt.io)\n4. **Compare hashes** - decode JWT and check if SHA-256 hash matches body\n5. **Test with minimal payload** to isolate issues\n6. **Verify environment variables** are properly set\n7. **Check Netlify webhook settings** for correct URL and secret\n\n### Debugging JWT Issues\n\nUse this comprehensive checklist to debug JWT verification problems:\n\n**Header Checks:**\n- [ ] JWT token is present in `x-webhook-signature` header\n- [ ] `x-netlify-event` header is set to `submission_created`\n- [ ] `Content-Type` header is `application/json`\n\n**JWT Structure:**\n- [ ] JWT has three parts separated by dots (header.payload.signature)\n- [ ] Each part is valid base64url encoded (no + or / or = characters)\n- [ ] JWT payload contains `sha256` field with 64 hex characters\n\n**Body Hash Verification:**\n- [ ] Request body hash matches `sha256` in JWT payload\n- [ ] Body hasn't been modified after signature was created\n- [ ] No middleware is altering the request body\n\n**Secret Configuration:**\n- [ ] `NETLIFY_FORM_JWS` environment variable is set correctly\n- [ ] Secret matches the one configured in Netlify settings\n- [ ] No whitespace or newlines in the secret value\n\n**Signature Verification:**\n- [ ] JWT signature algorithm is HS256 (HMAC-SHA256)\n- [ ] Signature verification is using the correct key\n- [ ] Base64url decoding is working correctly (not standard base64)\n\n**Debugging Tools:**\n1. Decode JWT at [jwt.io](https://jwt.io) to inspect header and payload\n2. Run `test-webhook.ts` to verify your secret and setup\n3. Check Val Town logs for detailed error messages\n4. Compare the body hash in logs with JWT payload `sha256` field\n\n### Test Script Troubleshooting\n\n| Issue | Symptom | Solution |\n|-------|---------|----------|\n| **Test returns 401** | `{\"ok\": false, \"error\": \"Invalid signature\"}` | 1. Verify `NETLIFY_FORM_JWS` env var is set correctly
2. Check secret matches Netlify
3. Ensure no typos in secret |\n| **Test returns 400** | `{\"ok\": false}` | 1. Verify `x-netlify-event` header is set
2. Check request format is correct
3. Ensure body is valid JSON |\n| **Test returns 500** | `{\"ok\": false, \"error\": \"Server configuration error\"}` | 1. Check webhook has `NETLIFY_FORM_JWS` env var
2. Check webhook has `SLACK_WEBHOOK_URL` env var
3. Verify both vals have access to env vars |\n| **Test hangs** | No response | 1. Check network connectivity
2. Verify webhook endpoint URL
3. Check for Val Town service issues |\n| **Second run fails** | Expected: should succeed with duplicate detection | This is **normal behavior** - webhook detects duplicate submission ID |\n| **Hash mismatch** | Body hash doesn't match JWT payload | 1. Ensure body isn't being modified
2. Check encoding is consistent (UTF-8)
3. Verify no whitespace changes |\n\n**Testing the Test Script:**\n```bash\n# Verify JWT is being generated correctly\n# Decode the JWT at https://jwt.io to inspect:\n# - Header should have: {\"alg\":\"HS256\",\"typ\":\"JWT\"}\n# - Payload should have: {\"iss\":\"netlify\",\"sha256\":\"...\"}\n# - Signature should verify with your NETLIFY_FORM_JWS secret\n```\n\n## Files\n\n| File | Type | Purpose | Key Features |\n|------|------|---------|--------------|\n| `main.ts` | HTTP handler | Main webhook endpoint | JWT verification, signature validation, data processing, notifications |\n| `test-webhook.ts` | Script | Automated test suite | JWT signing, signature generation, end-to-end testing |\n| `README.md` | Documentation | Project documentation | Setup guide, security details, troubleshooting |\n\n### File Details\n\n#### `main.ts`\nThe main webhook handler that:\n- Receives POST requests from Netlify\n- Verifies JWT signatures using HMAC-SHA256\n- Validates request body integrity via SHA-256 hash comparison\n- Processes form submissions\n- Stores data in blob storage with deduplication\n- Sends email and Slack notifications\n\n**Key Functions:**\n- `verifyNetlifySignature()` - JWT verification logic\n- `base64UrlToArrayBuffer()` - Base64url decoding for JWT\n- Main HTTP handler - Request processing and orchestration\n\n#### `test-webhook.ts`\nAn automated test script that:\n- Generates valid JWT signatures matching Netlify's implementation\n- Creates test requests with proper headers\n- Verifies the webhook's security and functionality\n- Provides detailed test results\n\n**Key Functions:**\n- `base64UrlEncode()` - Encodes data to base64url format\n- `generateNetlifyJWT()` - Creates valid JWT tokens with HMAC-SHA256 signatures\n- Main test function - Executes the test and reports results\n\n**Why This Test is Important:**\n- Validates JWT signing/verification is working correctly\n- Ensures webhook security is properly configured\n- Proves the integration with Netlify will work\n- Catches configuration errors before production\n\n## License\n\nThis project is part of Preston-Werner Ventures' internal tooling.\n",[],[182],{"_105":191,"_97":192,"_162":193,"_164":-5,"_165":147,"_166":194,"_168":120,"_107":195,"_102":196,"_171":197,"_173":198,"_175":22,"_176":-5,"_177":199,"_100":200},"3bae6aee-df63-11f0-858c-42dde27851f2","agent.ts","82ab5bc8-df5e-11f0-8ebe-42dde27851f2",138,["D",1766427774444],5,"script","import { readFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { Agent, run, webSearchTool } from \"npm:@openai/agents@0.3.0\";\n// import { storeLead } from \"./db.ts\";\n\nconst PROMPT = await readFile(\"/PROMPT.txt\");\nconst agent = new Agent({\n name: \"Researcher\",\n model: \"gpt-5\",\n tools: [webSearchTool()],\n instructions: PROMPT,\n});\n\nexport async function processLead(inputData: Record) {\n // Early API key check to avoid confusing when using the tester ui\n if (!Deno.env.get(\"OPENAI_API_KEY\")) {\n throw new Error(\"Add OPENAI_API_KEY in Environment Variables\");\n }\n\n const result = await run(agent, JSON.stringify(inputData));\n const outputData = JSON.parse(result.finalOutput);\n // await storeLead(inputData, outputData);\n console.log(inputData);\n console.log(result);\n console.log(result.finalOutput);\n return { outputData };\n}",[],[192],{"_105":202,"_97":203,"_162":118,"_164":-5,"_165":147,"_166":204,"_168":120,"_107":205,"_102":206,"_171":207,"_173":208,"_175":22,"_176":-5,"_177":209,"_100":210},"11092664-df61-11f0-86bb-42dde27851f2","main.ts",130,["D",1766426843904],97,"http","import { blob } from \"https://esm.town/v/std/blob\";\nimport { email } from \"https://esm.town/v/std/email\";\nimport { IncomingWebhook } from \"npm:@slack/webhook\";\nimport { jwtVerify } from \"npm:jose@5.9.6\";\nimport { createHash } from \"node:crypto\";\nimport { processLead } from \"./agent.ts\";\n\n// Learn more: https://docs.val.town/guides/creating-a-webhook/\nexport default async function (req: Request): Promise {\n console.log(req);\n if (req.method !== \"POST\") {\n return Response.json(\"PWV Deal Webhook - Method not allowed\", {\n status: 405,\n });\n }\n\n const event = req.headers.get(\"x-netlify-event\");\n const signature = req.headers.get(\"x-webhook-signature\");\n console.log(event, signature);\n\n if (!event || !signature) {\n console.error(\"Missing event and signature headers\", req.headers);\n return Response.json({ ok: false }, { status: 400 });\n }\n\n // Verify JWT signature using jose\n const jwtSecret = Deno.env.get(\"NETLIFY_FORM_JWS\");\n if (!jwtSecret) {\n console.error(\"Missing NETLIFY_FORM_JWS environment variable\");\n return Response.json({ ok: false, error: \"Server configuration error\" }, {\n status: 500,\n });\n }\n\n let json;\n try {\n // Get the request body\n const body = await req.text();\n\n // Verify the JWT signature using jose\n const secretKey = new TextEncoder().encode(jwtSecret);\n const { payload } = await jwtVerify(signature, secretKey, {\n issuer: \"netlify\",\n algorithms: [\"HS256\"],\n });\n\n // Hash the body and compare with the JWT payload\n const hashedBody = createHash(\"sha256\").update(body).digest(\"hex\");\n\n if (payload.sha256 !== hashedBody) {\n console.error(\"Body hash mismatch\");\n return Response.json(\n {\n ok: false,\n error: \"Signature verification failed - body hash mismatch\",\n },\n { status: 401 },\n );\n }\n\n console.log(\"Webhook signature verified successfully\");\n\n // Parse the JSON from the body we already read\n json = JSON.parse(body);\n } catch (verificationError) {\n console.error(\"Error verifying webhook signature:\", verificationError);\n return Response.json(\n { ok: false, error: \"Signature verification failed\" },\n { status: 401 },\n );\n }\n\n if (event !== \"submission_created\") {\n console.error(\"Unknown event\", event);\n return Response.json({ ok: false }, { status: 400 });\n }\n\n try {\n const {\n id,\n data,\n } = json;\n\n const { name, email: email_address, company, website, deck, message } =\n data;\n\n if (!email_address) {\n console.error(\"Missing email\", data);\n return Response.json({ ok: false, error: \"Missing email address\" }, {\n status: 400,\n });\n }\n\n // store data in a blob\n const key = `pwv-fund-submission-${id}`;\n\n // check if data already exists\n const existing = await blob.getJSON(key);\n\n if (existing) {\n console.warn(\"Form submission already exists\", key, existing);\n return Response.json(\n { ok: false, error: \"Duplicate submission - already processed\" },\n { status: 409 },\n );\n }\n\n await blob.setJSON(key, data);\n\n console.debug(\"Stored data\", key, data);\n\n const domain = new URL(website).hostname;\n console.log(\"Domain\", domain);\n\n // format the email\n const emailBody =\n `${domain}\\n\\n\\n\\nName: ${name}\\nEmail: ${email_address}\\nCompany: ${company}\\nWebsite: ${website}\\n\\nDeck: ${deck}\\n\\nMessage:\\n\\n${message}\\n\\n`;\n\n console.log(\"Sending email\", emailBody);\n\n const subject = `PWV Fund - New Submission - ${company}`;\n\n // send an email\n await email({\n to: \"dt@prestonwernerventures.com\",\n subject,\n text: emailBody,\n });\n\n console.log(\"Email sent\", emailBody);\n\n // Send to Slack\n const slack = new IncomingWebhook(Deno.env.get(\"SLACK_WEBHOOK_URL\"));\n const EDIT = `<${import.meta.url.replace(\"esm\", \"val\")}|(edit val)>`;\n await slack.send(`🥳 ${subject}}: \\n \\n ${emailBody}`);\n\n await processLead({\n name,\n email: email_address,\n company,\n website,\n deck,\n message,\n });\n } catch (error) {\n console.error(\"Something went wrong\", error);\n return Response.json({ ok: false, error: \"Internal server error\" }, {\n status: 500,\n });\n }\n\n return Response.json({ ok: true });\n}",[],[203],{"_105":212,"_97":213,"_162":214,"_164":-5,"_165":147,"_166":146,"_168":120,"_107":215,"_102":216,"_171":197,"_173":217,"_175":22,"_176":-5,"_177":218,"_100":219},"4ffc71da-df63-11f0-9e9c-42dde27851f2","test-agent.ts","56b30126-df61-11f0-bc79-42dde27851f2",["D",1766427808511],7,"import { processLead } from \"./agent.ts\";\n\nconst data = {\n name: \"Hariharasudhan Saminathan\",\n email: \"theofficialhari@gmail.com\",\n company: \"NameFridayAI\",\n website: \"https://fridayai.org/\",\n deck:\n \"https://drive.google.com/file/d/1iDTLmfoItbPS-fHd8LkYxLAzdPSUmBan/view?usp=sharing\",\n message:\n `FridayAI is building the AI operating system for real estate teams. At its core, we do for real estate what companies like Harvey and Legora have done for law — but purpose-built for a highly Excel- and Office-centric industry. We embed AI directly inside Excel, Word, PowerPoint, and Outlook to automate financial model checks, investment memo drafting, IC deck assembly, and email summarisation. Our long-term vision is to extend this layer across property management, leasing, and asset management, with AI assistants tailored to every real estate subsector.\n \n We’ve validated strong demand through 30+ customer interviews and active pilots with CBRE, Cushman & Wakefield, and Tokyo Land Singapore. Early users are already saving 15–20 hours per week. From mid-January, we’re beginning structured pitches with ~20 large real estate organisations as teams return from the holidays.\n \n Our team combines deep institutional real estate experience with strong technical research backgrounds. I previously worked at CapitaLand in private funds. Zihan holds a PhD in Computer Science from the University of Auckland. Simon holds a PhD in Urban Modelling from Cambridge and a Master’s in Data Science from Harvard. We’re also supported by two advisors with over 60 years of combined institutional real estate experience.\n \n We are currently pre-seed and are happy to speak with the pre-seed team to share learnings from pilots and discuss next steps.\n Excel add-in demo: https://youtu.be/GIPCOrgPVRg`,\n};\n\nconst outputData = await processLead(data);\nconsole.log(\"Test research agent\", outputData);",[],[213],{"_105":221,"_97":101,"_162":222,"_164":-5,"_165":147,"_166":223,"_168":120,"_107":224,"_102":196,"_171":197,"_173":225,"_175":22,"_176":-5,"_177":226,"_100":227},"2284d1bc-df5d-11f0-827b-42dde27851f2","592ef0d6-df5c-11f0-a09d-42dde27851f2",116,["D",1766425155250],"import { SignJWT } from \"npm:jose@5.9.6\";\nimport { createHash } from \"node:crypto\";\n\n/**\n * Test Script for PWV Fund Application Webhook\n * ==============================================\n * \n * This script simulates a Netlify form submission webhook by:\n * 1. Creating a sample payload from real production data\n * 2. Calculating a SHA-256 hash of the request body\n * 3. Generating a valid JWT token signed with HMAC-SHA256\n * 4. Sending a POST request with proper headers to the webhook\n * 5. Displaying detailed test results\n * \n * HOW IT WORKS:\n * -------------\n * Netlify signs webhooks using JWT (JSON Web Tokens) with the following process:\n * \n * 1. Hash the Request Body:\n * - Calculate SHA-256 hash of the entire JSON body\n * - Convert to hexadecimal string\n * \n * 2. Create JWT Token:\n * - Header: {\"alg\": \"HS256\", \"typ\": \"JWT\"}\n * - Payload: {\"iss\": \"netlify\", \"sha256\": \"\", \"iat\": }\n * - Sign with HMAC-SHA256 using the shared secret (NETLIFY_FORM_JWS)\n * \n * 3. Send Request:\n * - Include JWT in x-webhook-signature header\n * - Include event type in x-netlify-event header\n * - POST JSON body to webhook endpoint\n * \n * The webhook verifies the signature by:\n * - Extracting the JWT token from the header\n * - Calculating its own SHA-256 hash of the request body\n * - Comparing the hash with the one in the JWT payload\n * - Verifying the JWT signature using the shared secret\n * - Only processing requests that pass both checks\n * \n * USAGE:\n * ------\n * 1. Click \"Run\" in Val Town editor\n * 2. Or import: `import test from \"./test-webhook.ts\"`\n * 3. Script runs automatically on import\n * \n * EXPECTED BEHAVIOR:\n * ------------------\n * - Each run: ✅ 200 OK - Submission processed, email sent, Slack notified\n * - Duplicate ID: ❌ 409 Conflict - Submission already exists\n * - Wrong secret: ❌ 401 Unauthorized - Invalid signature\n * - Modified body: ❌ 401 Unauthorized - Body hash mismatch\n * \n * CUSTOMIZATION:\n * --------------\n * To test with different data, modify the `sampleData` object below.\n * The `id` field is automatically generated with a timestamp to ensure uniqueness.\n * \n * SECURITY:\n * ---------\n * This test proves that:\n * ✅ JWT signature verification is working correctly\n * ✅ Body integrity checking prevents tampering\n * ✅ Only requests with valid signatures are processed\n * ✅ The webhook correctly implements Netlify's security model\n * \n * See README.md for complete documentation.\n */\n\n// Sample data from the logs\nconst sampleData = {\n number: 95,\n title: null,\n email: \"dt@example.com\",\n name: \"DT\",\n first_name: \"DT\",\n last_name: null,\n company: \"Test Company\",\n summary: \"This is a test message\",\n body: \"This is a test message\",\n data: {\n name: \"DT\",\n email: \"dt@example.com\",\n company: \"Test Company\",\n website: \"https://www.example.com\",\n deck: \"\",\n message: \"This is a test message\",\n ip: \"71.234.218.6\",\n user_agent: \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15\",\n referrer: \"https://pwv.com/apply/\"\n },\n created_at: \"2025-12-22T17:31:35.939Z\",\n human_fields: {\n Name: \"DT\",\n Email: \"dt@example.com\",\n \"Company Name\": \"Test Company\",\n Website: \"https://www.example.com\",\n \"Pitch Deck\": \"\",\n Message: \"This is a test message\"\n },\n ordered_human_fields: [\n { title: \"Name\", name: \"name\", value: \"DT\" },\n { title: \"Email\", name: \"email\", value: \"dt@example.com\" },\n { title: \"Company Name\", name: \"company\", value: \"Test Company\" },\n {\n title: \"Website\",\n name: \"website\",\n value: \"https://www.example.com\"\n },\n { title: \"Pitch Deck\", name: \"deck\", value: \"\" },\n {\n title: \"Message\",\n name: \"message\",\n value: \"This is a test message\"\n }\n ],\n id: `test-${Date.now()}`, // Generate unique ID for each test run\n form_id: \"68dfcdf57cfcdb0008d62c8f\",\n site_url: \"https://pwv.com\",\n site_name: \"pwv-www\",\n form_name: \"apply\"\n};\n\n/**\n * Create a JWT signature for the webhook payload\n * \n * This function replicates Netlify's JWT signing process:\n * 1. Hash the request body using SHA-256\n * 2. Create a JWT with the hash in the payload\n * 3. Sign the JWT using HMAC-SHA256 with the shared secret\n * \n * JWT Structure:\n * - Header: {\"alg\": \"HS256\", \"typ\": \"JWT\"}\n * - Payload: {\"iss\": \"netlify\", \"sha256\": \"\", \"iat\": }\n * - Signature: HMAC-SHA256(header + \".\" + payload, secret)\n * \n * @param body - The JSON request body as a string\n * @param secret - The shared secret key (NETLIFY_FORM_JWS)\n * @returns JWT token in format: header.payload.signature\n */\nasync function createWebhookSignature(body: string, secret: string): Promise {\n // Step 1: Calculate SHA-256 hash of the request body\n const hashedBody = createHash(\"sha256\").update(body).digest(\"hex\");\n \n // Step 2: Encode the secret for cryptographic use\n const secretKey = new TextEncoder().encode(secret);\n \n // Step 3: Create and sign the JWT\n // - Uses HS256 algorithm (HMAC with SHA-256)\n // - Includes body hash in payload for integrity verification\n // - Sets issuer to \"netlify\" to match Netlify's implementation\n // - Includes issued-at timestamp\n const jwt = await new SignJWT({ sha256: hashedBody })\n .setProtectedHeader({ alg: \"HS256\" })\n .setIssuer(\"netlify\")\n .setIssuedAt()\n .sign(secretKey);\n \n return jwt;\n}\n\n/**\n * Test the webhook endpoint\n */\nasync function testWebhook() {\n const jwtSecret = Deno.env.get(\"NETLIFY_FORM_JWS\");\n \n if (!jwtSecret) {\n console.error(\"❌ Missing NETLIFY_FORM_JWS environment variable\");\n return;\n }\n \n // The webhook endpoint URL\n const webhookUrl = \"https://pwv--ef32c626b35a11f0a9a40224a6c84d84.web.val.run\";\n \n // Convert sample data to JSON string\n const body = JSON.stringify(sampleData);\n \n // Create the JWT signature\n const signature = await createWebhookSignature(body, jwtSecret);\n \n console.log(\"🧪 Testing webhook with sample data...\");\n console.log(\"📍 Endpoint:\", webhookUrl);\n console.log(\"📦 Payload ID:\", sampleData.id);\n console.log(\"👤 Test user:\", sampleData.data.name, `<${sampleData.data.email}>`);\n console.log(\"🏢 Company:\", sampleData.data.company);\n console.log(\"\");\n \n try {\n const response = await fetch(webhookUrl, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"x-netlify-event\": \"submission_created\",\n \"x-webhook-signature\": signature\n },\n body: body\n });\n \n const responseData = await response.json();\n \n console.log(\"📊 Response Status:\", response.status);\n console.log(\"📄 Response Body:\", responseData);\n \n if (response.ok) {\n console.log(\"✅ Webhook test successful!\");\n } else {\n console.log(\"❌ Webhook test failed!\");\n }\n } catch (error) {\n console.error(\"❌ Error testing webhook:\", error);\n }\n}\n\n// Run the test\nawait testWebhook();\n",[],[101],"files",[159,180,190,201,211,220],"counts",{"_232":33,"_233":234,"_235":234,"_236":237,"_241":242},"pulls","branches",2,"forks","envVars",{"_238":239,"_240":33},"count",3,"emptyCount","connections",{"_238":33,"_243":33},"unfilledCount","contents",[],{"_105":221,"_97":101,"_162":222,"_164":-5,"_165":147,"_166":223,"_168":120,"_107":247,"_102":196,"_171":197,"_173":225,"_175":22,"_176":-5,"_100":248},["D",1766425155250],[101],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.branch.$branch.history_.$",{"_95":96,"_97":98,"_99":45,"_100":101,"_103":257,"_172":262,"_265":266,"_295":296,"_304":-7,"_305":33,"_306":22},{"_105":106,"_97":98,"_107":258,"_109":-5,"_110":22,"_111":112,"_113":114,"_115":-5,"_14":116,"_117":118,"_119":120,"_121":120,"_122":-5,"_123":33,"_16":124,"_125":-5,"_126":-5,"_127":128,"_129":128,"_130":131,"_132":131,"_133":131,"_134":128,"_135":128,"_23":259,"_139":260,"_144":261,"_156":22},["D",1761586358977],{"_95":96,"_137":138},{"_95":96,"_141":138,"_14":-5,"_142":143},{"_102":146,"_97":45,"_105":147,"_148":106,"_149":-5,"_150":-5,"_151":-5,"_152":-5,"_153":-5,"_154":98,"_155":96},{"_105":221,"_97":101,"_162":222,"_164":-5,"_165":147,"_166":223,"_168":120,"_107":263,"_102":196,"_171":197,"_173":225,"_175":22,"_176":-5,"_100":264},["D",1766425155250],[101],"history",[267,269,274,279,284,290],{"_105":221,"_165":147,"_162":222,"_97":101,"_173":225,"_171":197,"_102":196,"_164":-5,"_107":268,"_166":223,"_176":-5},["D",1766425155250],{"_105":270,"_165":147,"_162":222,"_97":101,"_173":271,"_171":197,"_102":170,"_164":-5,"_107":272,"_166":273,"_176":-5},"2186eb38-df5d-11f0-827b-42dde27851f2","import { SignJWT } from \"npm:jose@5.9.6\";\nimport { createHash } from \"node:crypto\";\n\n/**\n * Test Script for PWV Fund Application Webhook\n * ==============================================\n * \n * This script simulates a Netlify form submission webhook by:\n * 1. Creating a sample payload from real production data\n * 2. Calculating a SHA-256 hash of the request body\n * 3. Generating a valid JWT token signed with HMAC-SHA256\n * 4. Sending a POST request with proper headers to the webhook\n * 5. Displaying detailed test results\n * \n * HOW IT WORKS:\n * -------------\n * Netlify signs webhooks using JWT (JSON Web Tokens) with the following process:\n * \n * 1. Hash the Request Body:\n * - Calculate SHA-256 hash of the entire JSON body\n * - Convert to hexadecimal string\n * \n * 2. Create JWT Token:\n * - Header: {\"alg\": \"HS256\", \"typ\": \"JWT\"}\n * - Payload: {\"iss\": \"netlify\", \"sha256\": \"\", \"iat\": }\n * - Sign with HMAC-SHA256 using the shared secret (NETLIFY_FORM_JWS)\n * \n * 3. Send Request:\n * - Include JWT in x-webhook-signature header\n * - Include event type in x-netlify-event header\n * - POST JSON body to webhook endpoint\n * \n * The webhook verifies the signature by:\n * - Extracting the JWT token from the header\n * - Calculating its own SHA-256 hash of the request body\n * - Comparing the hash with the one in the JWT payload\n * - Verifying the JWT signature using the shared secret\n * - Only processing requests that pass both checks\n * \n * USAGE:\n * ------\n * 1. Click \"Run\" in Val Town editor\n * 2. Or import: `import test from \"./test-webhook.ts\"`\n * 3. Script runs automatically on import\n * \n * EXPECTED BEHAVIOR:\n * ------------------\n * - Each run: ✅ 200 OK - Submission processed, email sent, Slack notified\n * - Duplicate ID: ❌ 409 Conflict - Submission already exists\n * - Wrong secret: ❌ 401 Unauthorized - Invalid signature\n * - Modified body: ❌ 401 Unauthorized - Body hash mismatch\n * \n * CUSTOMIZATION:\n * --------------\n * To test with different data, modify the `sampleData` object below.\n * Remember to change the `id` field for each unique test to avoid duplicate detection.\n * \n * SECURITY:\n * ---------\n * This test proves that:\n * ✅ JWT signature verification is working correctly\n * ✅ Body integrity checking prevents tampering\n * ✅ Only requests with valid signatures are processed\n * ✅ The webhook correctly implements Netlify's security model\n * \n * See README.md for complete documentation.\n */\n\n// Sample data from the logs\nconst sampleData = {\n number: 95,\n title: null,\n email: \"dt@example.com\",\n name: \"DT\",\n first_name: \"DT\",\n last_name: null,\n company: \"Test Company\",\n summary: \"This is a test message\",\n body: \"This is a test message\",\n data: {\n name: \"DT\",\n email: \"dt@example.com\",\n company: \"Test Company\",\n website: \"https://www.example.com\",\n deck: \"\",\n message: \"This is a test message\",\n ip: \"71.234.218.6\",\n user_agent: \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15\",\n referrer: \"https://pwv.com/apply/\"\n },\n created_at: \"2025-12-22T17:31:35.939Z\",\n human_fields: {\n Name: \"DT\",\n Email: \"dt@example.com\",\n \"Company Name\": \"Test Company\",\n Website: \"https://www.example.com\",\n \"Pitch Deck\": \"\",\n Message: \"This is a test message\"\n },\n ordered_human_fields: [\n { title: \"Name\", name: \"name\", value: \"DT\" },\n { title: \"Email\", name: \"email\", value: \"dt@example.com\" },\n { title: \"Company Name\", name: \"company\", value: \"Test Company\" },\n {\n title: \"Website\",\n name: \"website\",\n value: \"https://www.example.com\"\n },\n { title: \"Pitch Deck\", name: \"deck\", value: \"\" },\n {\n title: \"Message\",\n name: \"message\",\n value: \"This is a test message\"\n }\n ],\n id: `test-${Date.now()}`, // Generate unique ID for each test run\n form_id: \"68dfcdf57cfcdb0008d62c8f\",\n site_url: \"https://pwv.com\",\n site_name: \"pwv-www\",\n form_name: \"apply\"\n};\n\n/**\n * Create a JWT signature for the webhook payload\n * \n * This function replicates Netlify's JWT signing process:\n * 1. Hash the request body using SHA-256\n * 2. Create a JWT with the hash in the payload\n * 3. Sign the JWT using HMAC-SHA256 with the shared secret\n * \n * JWT Structure:\n * - Header: {\"alg\": \"HS256\", \"typ\": \"JWT\"}\n * - Payload: {\"iss\": \"netlify\", \"sha256\": \"\", \"iat\": }\n * - Signature: HMAC-SHA256(header + \".\" + payload, secret)\n * \n * @param body - The JSON request body as a string\n * @param secret - The shared secret key (NETLIFY_FORM_JWS)\n * @returns JWT token in format: header.payload.signature\n */\nasync function createWebhookSignature(body: string, secret: string): Promise {\n // Step 1: Calculate SHA-256 hash of the request body\n const hashedBody = createHash(\"sha256\").update(body).digest(\"hex\");\n \n // Step 2: Encode the secret for cryptographic use\n const secretKey = new TextEncoder().encode(secret);\n \n // Step 3: Create and sign the JWT\n // - Uses HS256 algorithm (HMAC with SHA-256)\n // - Includes body hash in payload for integrity verification\n // - Sets issuer to \"netlify\" to match Netlify's implementation\n // - Includes issued-at timestamp\n const jwt = await new SignJWT({ sha256: hashedBody })\n .setProtectedHeader({ alg: \"HS256\" })\n .setIssuer(\"netlify\")\n .setIssuedAt()\n .sign(secretKey);\n \n return jwt;\n}\n\n/**\n * Test the webhook endpoint\n */\nasync function testWebhook() {\n const jwtSecret = Deno.env.get(\"NETLIFY_FORM_JWS\");\n \n if (!jwtSecret) {\n console.error(\"❌ Missing NETLIFY_FORM_JWS environment variable\");\n return;\n }\n \n // The webhook endpoint URL\n const webhookUrl = \"https://pwv--ef32c626b35a11f0a9a40224a6c84d84.web.val.run\";\n \n // Convert sample data to JSON string\n const body = JSON.stringify(sampleData);\n \n // Create the JWT signature\n const signature = await createWebhookSignature(body, jwtSecret);\n \n console.log(\"🧪 Testing webhook with sample data...\");\n console.log(\"📍 Endpoint:\", webhookUrl);\n console.log(\"📦 Payload ID:\", sampleData.id);\n console.log(\"👤 Test user:\", sampleData.data.name, `<${sampleData.data.email}>`);\n console.log(\"🏢 Company:\", sampleData.data.company);\n console.log(\"\");\n \n try {\n const response = await fetch(webhookUrl, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"x-netlify-event\": \"submission_created\",\n \"x-webhook-signature\": signature\n },\n body: body\n });\n \n const responseData = await response.json();\n \n console.log(\"📊 Response Status:\", response.status);\n console.log(\"📄 Response Body:\", responseData);\n \n if (response.ok) {\n console.log(\"✅ Webhook test successful!\");\n } else {\n console.log(\"❌ Webhook test failed!\");\n }\n } catch (error) {\n console.error(\"❌ Error testing webhook:\", error);\n }\n}\n\n// Run the test\nawait testWebhook();\n",["D",1766425153586],115,{"_105":275,"_165":147,"_162":222,"_97":101,"_173":276,"_171":197,"_102":239,"_164":-5,"_107":277,"_166":278,"_176":-5},"20003814-df5d-11f0-827b-42dde27851f2","import { SignJWT } from \"npm:jose@5.9.6\";\nimport { createHash } from \"node:crypto\";\n\n/**\n * Test Script for PWV Fund Application Webhook\n * ==============================================\n * \n * This script simulates a Netlify form submission webhook by:\n * 1. Creating a sample payload from real production data\n * 2. Calculating a SHA-256 hash of the request body\n * 3. Generating a valid JWT token signed with HMAC-SHA256\n * 4. Sending a POST request with proper headers to the webhook\n * 5. Displaying detailed test results\n * \n * HOW IT WORKS:\n * -------------\n * Netlify signs webhooks using JWT (JSON Web Tokens) with the following process:\n * \n * 1. Hash the Request Body:\n * - Calculate SHA-256 hash of the entire JSON body\n * - Convert to hexadecimal string\n * \n * 2. Create JWT Token:\n * - Header: {\"alg\": \"HS256\", \"typ\": \"JWT\"}\n * - Payload: {\"iss\": \"netlify\", \"sha256\": \"\", \"iat\": }\n * - Sign with HMAC-SHA256 using the shared secret (NETLIFY_FORM_JWS)\n * \n * 3. Send Request:\n * - Include JWT in x-webhook-signature header\n * - Include event type in x-netlify-event header\n * - POST JSON body to webhook endpoint\n * \n * The webhook verifies the signature by:\n * - Extracting the JWT token from the header\n * - Calculating its own SHA-256 hash of the request body\n * - Comparing the hash with the one in the JWT payload\n * - Verifying the JWT signature using the shared secret\n * - Only processing requests that pass both checks\n * \n * USAGE:\n * ------\n * 1. Click \"Run\" in Val Town editor\n * 2. Or import: `import test from \"./test-webhook.ts\"`\n * 3. Script runs automatically on import\n * \n * EXPECTED BEHAVIOR:\n * ------------------\n * - First run: ✅ 200 OK - Submission processed, email sent, Slack notified\n * - Second run: ✅ 200 OK - Duplicate detected, returns early (expected)\n * - Wrong secret: ❌ 401 Unauthorized - Invalid signature\n * - Modified body: ❌ 401 Unauthorized - Body hash mismatch\n * \n * CUSTOMIZATION:\n * --------------\n * To test with different data, modify the `sampleData` object below.\n * Remember to change the `id` field for each unique test to avoid duplicate detection.\n * \n * SECURITY:\n * ---------\n * This test proves that:\n * ✅ JWT signature verification is working correctly\n * ✅ Body integrity checking prevents tampering\n * ✅ Only requests with valid signatures are processed\n * ✅ The webhook correctly implements Netlify's security model\n * \n * See README.md for complete documentation.\n */\n\n// Sample data from the logs\nconst sampleData = {\n number: 95,\n title: null,\n email: \"dt@example.com\",\n name: \"DT\",\n first_name: \"DT\",\n last_name: null,\n company: \"Test Company\",\n summary: \"This is a test message\",\n body: \"This is a test message\",\n data: {\n name: \"DT\",\n email: \"dt@example.com\",\n company: \"Test Company\",\n website: \"https://www.example.com\",\n deck: \"\",\n message: \"This is a test message\",\n ip: \"71.234.218.6\",\n user_agent: \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15\",\n referrer: \"https://pwv.com/apply/\"\n },\n created_at: \"2025-12-22T17:31:35.939Z\",\n human_fields: {\n Name: \"DT\",\n Email: \"dt@example.com\",\n \"Company Name\": \"Test Company\",\n Website: \"https://www.example.com\",\n \"Pitch Deck\": \"\",\n Message: \"This is a test message\"\n },\n ordered_human_fields: [\n { title: \"Name\", name: \"name\", value: \"DT\" },\n { title: \"Email\", name: \"email\", value: \"dt@example.com\" },\n { title: \"Company Name\", name: \"company\", value: \"Test Company\" },\n {\n title: \"Website\",\n name: \"website\",\n value: \"https://www.example.com\"\n },\n { title: \"Pitch Deck\", name: \"deck\", value: \"\" },\n {\n title: \"Message\",\n name: \"message\",\n value: \"This is a test message\"\n }\n ],\n id: `test-${Date.now()}`, // Generate unique ID for each test run\n form_id: \"68dfcdf57cfcdb0008d62c8f\",\n site_url: \"https://pwv.com\",\n site_name: \"pwv-www\",\n form_name: \"apply\"\n};\n\n/**\n * Create a JWT signature for the webhook payload\n * \n * This function replicates Netlify's JWT signing process:\n * 1. Hash the request body using SHA-256\n * 2. Create a JWT with the hash in the payload\n * 3. Sign the JWT using HMAC-SHA256 with the shared secret\n * \n * JWT Structure:\n * - Header: {\"alg\": \"HS256\", \"typ\": \"JWT\"}\n * - Payload: {\"iss\": \"netlify\", \"sha256\": \"\", \"iat\": }\n * - Signature: HMAC-SHA256(header + \".\" + payload, secret)\n * \n * @param body - The JSON request body as a string\n * @param secret - The shared secret key (NETLIFY_FORM_JWS)\n * @returns JWT token in format: header.payload.signature\n */\nasync function createWebhookSignature(body: string, secret: string): Promise {\n // Step 1: Calculate SHA-256 hash of the request body\n const hashedBody = createHash(\"sha256\").update(body).digest(\"hex\");\n \n // Step 2: Encode the secret for cryptographic use\n const secretKey = new TextEncoder().encode(secret);\n \n // Step 3: Create and sign the JWT\n // - Uses HS256 algorithm (HMAC with SHA-256)\n // - Includes body hash in payload for integrity verification\n // - Sets issuer to \"netlify\" to match Netlify's implementation\n // - Includes issued-at timestamp\n const jwt = await new SignJWT({ sha256: hashedBody })\n .setProtectedHeader({ alg: \"HS256\" })\n .setIssuer(\"netlify\")\n .setIssuedAt()\n .sign(secretKey);\n \n return jwt;\n}\n\n/**\n * Test the webhook endpoint\n */\nasync function testWebhook() {\n const jwtSecret = Deno.env.get(\"NETLIFY_FORM_JWS\");\n \n if (!jwtSecret) {\n console.error(\"❌ Missing NETLIFY_FORM_JWS environment variable\");\n return;\n }\n \n // The webhook endpoint URL\n const webhookUrl = \"https://pwv--ef32c626b35a11f0a9a40224a6c84d84.web.val.run\";\n \n // Convert sample data to JSON string\n const body = JSON.stringify(sampleData);\n \n // Create the JWT signature\n const signature = await createWebhookSignature(body, jwtSecret);\n \n console.log(\"🧪 Testing webhook with sample data...\");\n console.log(\"📍 Endpoint:\", webhookUrl);\n console.log(\"📦 Payload ID:\", sampleData.id);\n console.log(\"👤 Test user:\", sampleData.data.name, `<${sampleData.data.email}>`);\n console.log(\"🏢 Company:\", sampleData.data.company);\n console.log(\"\");\n \n try {\n const response = await fetch(webhookUrl, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"x-netlify-event\": \"submission_created\",\n \"x-webhook-signature\": signature\n },\n body: body\n });\n \n const responseData = await response.json();\n \n console.log(\"📊 Response Status:\", response.status);\n console.log(\"📄 Response Body:\", responseData);\n \n if (response.ok) {\n console.log(\"✅ Webhook test successful!\");\n } else {\n console.log(\"❌ Webhook test failed!\");\n }\n } catch (error) {\n console.error(\"❌ Error testing webhook:\", error);\n }\n}\n\n// Run the test\nawait testWebhook();\n",["D",1766425151018],114,{"_105":280,"_165":147,"_162":222,"_97":101,"_173":281,"_171":197,"_102":234,"_164":-5,"_107":282,"_166":283,"_176":-5},"d74b8fba-df5c-11f0-a65a-42dde27851f2","import { SignJWT } from \"npm:jose@5.9.6\";\nimport { createHash } from \"node:crypto\";\n\n/**\n * Test Script for PWV Fund Application Webhook\n * ==============================================\n * \n * This script simulates a Netlify form submission webhook by:\n * 1. Creating a sample payload from real production data\n * 2. Calculating a SHA-256 hash of the request body\n * 3. Generating a valid JWT token signed with HMAC-SHA256\n * 4. Sending a POST request with proper headers to the webhook\n * 5. Displaying detailed test results\n * \n * HOW IT WORKS:\n * -------------\n * Netlify signs webhooks using JWT (JSON Web Tokens) with the following process:\n * \n * 1. Hash the Request Body:\n * - Calculate SHA-256 hash of the entire JSON body\n * - Convert to hexadecimal string\n * \n * 2. Create JWT Token:\n * - Header: {\"alg\": \"HS256\", \"typ\": \"JWT\"}\n * - Payload: {\"iss\": \"netlify\", \"sha256\": \"\", \"iat\": }\n * - Sign with HMAC-SHA256 using the shared secret (NETLIFY_FORM_JWS)\n * \n * 3. Send Request:\n * - Include JWT in x-webhook-signature header\n * - Include event type in x-netlify-event header\n * - POST JSON body to webhook endpoint\n * \n * The webhook verifies the signature by:\n * - Extracting the JWT token from the header\n * - Calculating its own SHA-256 hash of the request body\n * - Comparing the hash with the one in the JWT payload\n * - Verifying the JWT signature using the shared secret\n * - Only processing requests that pass both checks\n * \n * USAGE:\n * ------\n * 1. Click \"Run\" in Val Town editor\n * 2. Or import: `import test from \"./test-webhook.ts\"`\n * 3. Script runs automatically on import\n * \n * EXPECTED BEHAVIOR:\n * ------------------\n * - First run: ✅ 200 OK - Submission processed, email sent, Slack notified\n * - Second run: ✅ 200 OK - Duplicate detected, returns early (expected)\n * - Wrong secret: ❌ 401 Unauthorized - Invalid signature\n * - Modified body: ❌ 401 Unauthorized - Body hash mismatch\n * \n * CUSTOMIZATION:\n * --------------\n * To test with different data, modify the `sampleData` object below.\n * Remember to change the `id` field for each unique test to avoid duplicate detection.\n * \n * SECURITY:\n * ---------\n * This test proves that:\n * ✅ JWT signature verification is working correctly\n * ✅ Body integrity checking prevents tampering\n * ✅ Only requests with valid signatures are processed\n * ✅ The webhook correctly implements Netlify's security model\n * \n * See README.md for complete documentation.\n */\n\n// Sample data from the logs\nconst sampleData = {\n number: 95,\n title: null,\n email: \"dt@example.com\",\n name: \"DT\",\n first_name: \"DT\",\n last_name: null,\n company: \"Test Company\",\n summary: \"This is a test message\",\n body: \"This is a test message\",\n data: {\n name: \"DT\",\n email: \"dt@example.com\",\n company: \"Test Company\",\n website: \"https://www.example.com\",\n deck: \"\",\n message: \"This is a test message\",\n ip: \"71.234.218.6\",\n user_agent: \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15\",\n referrer: \"https://pwv.com/apply/\"\n },\n created_at: \"2025-12-22T17:31:35.939Z\",\n human_fields: {\n Name: \"DT\",\n Email: \"dt@example.com\",\n \"Company Name\": \"Test Company\",\n Website: \"https://www.example.com\",\n \"Pitch Deck\": \"\",\n Message: \"This is a test message\"\n },\n ordered_human_fields: [\n { title: \"Name\", name: \"name\", value: \"DT\" },\n { title: \"Email\", name: \"email\", value: \"dt@example.com\" },\n { title: \"Company Name\", name: \"company\", value: \"Test Company\" },\n {\n title: \"Website\",\n name: \"website\",\n value: \"https://www.example.com\"\n },\n { title: \"Pitch Deck\", name: \"deck\", value: \"\" },\n {\n title: \"Message\",\n name: \"message\",\n value: \"This is a test message\"\n }\n ],\n id: \"69498077f82665c79f3c0775\",\n form_id: \"68dfcdf57cfcdb0008d62c8f\",\n site_url: \"https://pwv.com\",\n site_name: \"pwv-www\",\n form_name: \"apply\"\n};\n\n/**\n * Create a JWT signature for the webhook payload\n * \n * This function replicates Netlify's JWT signing process:\n * 1. Hash the request body using SHA-256\n * 2. Create a JWT with the hash in the payload\n * 3. Sign the JWT using HMAC-SHA256 with the shared secret\n * \n * JWT Structure:\n * - Header: {\"alg\": \"HS256\", \"typ\": \"JWT\"}\n * - Payload: {\"iss\": \"netlify\", \"sha256\": \"\", \"iat\": }\n * - Signature: HMAC-SHA256(header + \".\" + payload, secret)\n * \n * @param body - The JSON request body as a string\n * @param secret - The shared secret key (NETLIFY_FORM_JWS)\n * @returns JWT token in format: header.payload.signature\n */\nasync function createWebhookSignature(body: string, secret: string): Promise {\n // Step 1: Calculate SHA-256 hash of the request body\n const hashedBody = createHash(\"sha256\").update(body).digest(\"hex\");\n \n // Step 2: Encode the secret for cryptographic use\n const secretKey = new TextEncoder().encode(secret);\n \n // Step 3: Create and sign the JWT\n // - Uses HS256 algorithm (HMAC with SHA-256)\n // - Includes body hash in payload for integrity verification\n // - Sets issuer to \"netlify\" to match Netlify's implementation\n // - Includes issued-at timestamp\n const jwt = await new SignJWT({ sha256: hashedBody })\n .setProtectedHeader({ alg: \"HS256\" })\n .setIssuer(\"netlify\")\n .setIssuedAt()\n .sign(secretKey);\n \n return jwt;\n}\n\n/**\n * Test the webhook endpoint\n */\nasync function testWebhook() {\n const jwtSecret = Deno.env.get(\"NETLIFY_FORM_JWS\");\n \n if (!jwtSecret) {\n console.error(\"❌ Missing NETLIFY_FORM_JWS environment variable\");\n return;\n }\n \n // The webhook endpoint URL\n const webhookUrl = \"https://pwv--ef32c626b35a11f0a9a40224a6c84d84.web.val.run\";\n \n // Convert sample data to JSON string\n const body = JSON.stringify(sampleData);\n \n // Create the JWT signature\n const signature = await createWebhookSignature(body, jwtSecret);\n \n console.log(\"🧪 Testing webhook with sample data...\");\n console.log(\"📍 Endpoint:\", webhookUrl);\n console.log(\"📦 Payload ID:\", sampleData.id);\n console.log(\"👤 Test user:\", sampleData.data.name, `<${sampleData.data.email}>`);\n console.log(\"🏢 Company:\", sampleData.data.company);\n console.log(\"\");\n \n try {\n const response = await fetch(webhookUrl, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"x-netlify-event\": \"submission_created\",\n \"x-webhook-signature\": signature\n },\n body: body\n });\n \n const responseData = await response.json();\n \n console.log(\"📊 Response Status:\", response.status);\n console.log(\"📄 Response Body:\", responseData);\n \n if (response.ok) {\n console.log(\"✅ Webhook test successful!\");\n } else {\n console.log(\"❌ Webhook test failed!\");\n }\n } catch (error) {\n console.error(\"❌ Error testing webhook:\", error);\n }\n}\n\n// Run the test\nawait testWebhook();\n",["D",1766425029042],109,{"_105":285,"_165":147,"_162":222,"_97":101,"_173":286,"_171":197,"_102":287,"_164":-5,"_107":288,"_166":289,"_176":-5},"d03be1f2-df5c-11f0-a65a-42dde27851f2","import { SignJWT } from \"npm:jose@5.9.6\";\nimport { createHash } from \"node:crypto\";\n\n/**\n * Test Script for PWV Fund Application Webhook\n * ==============================================\n * \n * This script simulates a Netlify form submission webhook by:\n * 1. Creating a sample payload from real production data\n * 2. Calculating a SHA-256 hash of the request body\n * 3. Generating a valid JWT token signed with HMAC-SHA256\n * 4. Sending a POST request with proper headers to the webhook\n * 5. Displaying detailed test results\n * \n * HOW IT WORKS:\n * -------------\n * Netlify signs webhooks using JWT (JSON Web Tokens) with the following process:\n * \n * 1. Hash the Request Body:\n * - Calculate SHA-256 hash of the entire JSON body\n * - Convert to hexadecimal string\n * \n * 2. Create JWT Token:\n * - Header: {\"alg\": \"HS256\", \"typ\": \"JWT\"}\n * - Payload: {\"iss\": \"netlify\", \"sha256\": \"\", \"iat\": }\n * - Sign with HMAC-SHA256 using the shared secret (NETLIFY_FORM_JWS)\n * \n * 3. Send Request:\n * - Include JWT in x-webhook-signature header\n * - Include event type in x-netlify-event header\n * - POST JSON body to webhook endpoint\n * \n * The webhook verifies the signature by:\n * - Extracting the JWT token from the header\n * - Calculating its own SHA-256 hash of the request body\n * - Comparing the hash with the one in the JWT payload\n * - Verifying the JWT signature using the shared secret\n * - Only processing requests that pass both checks\n * \n * USAGE:\n * ------\n * 1. Click \"Run\" in Val Town editor\n * 2. Or import: `import test from \"./test-webhook.ts\"`\n * 3. Script runs automatically on import\n * \n * EXPECTED BEHAVIOR:\n * ------------------\n * - First run: ✅ 200 OK - Submission processed, email sent, Slack notified\n * - Second run: ✅ 200 OK - Duplicate detected, returns early (expected)\n * - Wrong secret: ❌ 401 Unauthorized - Invalid signature\n * - Modified body: ❌ 401 Unauthorized - Body hash mismatch\n * \n * CUSTOMIZATION:\n * --------------\n * To test with different data, modify the `sampleData` object below.\n * Remember to change the `id` field for each unique test to avoid duplicate detection.\n * \n * SECURITY:\n * ---------\n * This test proves that:\n * ✅ JWT signature verification is working correctly\n * ✅ Body integrity checking prevents tampering\n * ✅ Only requests with valid signatures are processed\n * ✅ The webhook correctly implements Netlify's security model\n * \n * See README.md for complete documentation.\n */\n\n// Sample data from the logs\nconst sampleData = {\n number: 95,\n title: null,\n email: \"dt@example.com\",\n name: \"DT\",\n first_name: \"DT\",\n last_name: null,\n company: \"Test Company\",\n summary: \"This is a test message\",\n body: \"This is a test message\",\n data: {\n name: \"DT\",\n email: \"dt@example.com\",\n company: \"Test Company\",\n website: \"https://www.example.com\",\n deck: \"\",\n message: \"This is a test message\",\n ip: \"71.234.218.6\",\n user_agent: \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15\",\n referrer: \"https://pwv.com/apply/\"\n },\n created_at: \"2025-12-22T17:31:35.939Z\",\n human_fields: {\n Name: \"DT\",\n Email: \"dt@example.com\",\n \"Company Name\": \"Test Company\",\n Website: \"https://www.example.com\",\n \"Pitch Deck\": \"\",\n Message: \"This is a test message\"\n },\n ordered_human_fields: [\n { title: \"Name\", name: \"name\", value: \"DT\" },\n { title: \"Email\", name: \"email\", value: \"dt@example.com\" },\n { title: \"Company Name\", name: \"company\", value: \"Test Company\" },\n {\n title: \"Website\",\n name: \"website\",\n value: \"https://www.example.com\"\n },\n { title: \"Pitch Deck\", name: \"deck\", value: \"\" },\n {\n title: \"Message\",\n name: \"message\",\n value: \"This is a test message\"\n }\n ],\n id: \"69498077f82665c79f3c0775\",\n form_id: \"68dfcdf57cfcdb0008d62c8f\",\n site_url: \"https://pwv.com\",\n site_name: \"pwv-www\",\n form_name: \"apply\"\n};\n\n/**\n * Create a JWT signature for the webhook payload\n */\nasync function createWebhookSignature(body: string, secret: string): Promise {\n const hashedBody = createHash(\"sha256\").update(body).digest(\"hex\");\n \n const secretKey = new TextEncoder().encode(secret);\n \n const jwt = await new SignJWT({ sha256: hashedBody })\n .setProtectedHeader({ alg: \"HS256\" })\n .setIssuer(\"netlify\")\n .setIssuedAt()\n .sign(secretKey);\n \n return jwt;\n}\n\n/**\n * Test the webhook endpoint\n */\nasync function testWebhook() {\n const jwtSecret = Deno.env.get(\"NETLIFY_FORM_JWS\");\n \n if (!jwtSecret) {\n console.error(\"❌ Missing NETLIFY_FORM_JWS environment variable\");\n return;\n }\n \n // The webhook endpoint URL\n const webhookUrl = \"https://pwv--ef32c626b35a11f0a9a40224a6c84d84.web.val.run\";\n \n // Convert sample data to JSON string\n const body = JSON.stringify(sampleData);\n \n // Create the JWT signature\n const signature = await createWebhookSignature(body, jwtSecret);\n \n console.log(\"🧪 Testing webhook with sample data...\");\n console.log(\"📍 Endpoint:\", webhookUrl);\n console.log(\"📦 Payload ID:\", sampleData.id);\n console.log(\"👤 Test user:\", sampleData.data.name, `<${sampleData.data.email}>`);\n console.log(\"🏢 Company:\", sampleData.data.company);\n console.log(\"\");\n \n try {\n const response = await fetch(webhookUrl, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"x-netlify-event\": \"submission_created\",\n \"x-webhook-signature\": signature\n },\n body: body\n });\n \n const responseData = await response.json();\n \n console.log(\"📊 Response Status:\", response.status);\n console.log(\"📄 Response Body:\", responseData);\n \n if (response.ok) {\n console.log(\"✅ Webhook test successful!\");\n } else {\n console.log(\"❌ Webhook test failed!\");\n }\n } catch (error) {\n console.error(\"❌ Error testing webhook:\", error);\n }\n}\n\n// Run the test\nawait testWebhook();\n",1,["D",1766425017195],105,{"_105":291,"_165":147,"_162":222,"_97":101,"_173":292,"_171":197,"_102":33,"_164":-5,"_107":293,"_166":294,"_176":-5},"592ef004-df5c-11f0-a09d-42dde27851f2","import { SignJWT } from \"npm:jose@5.9.6\";\nimport { createHash } from \"node:crypto\";\n\n/**\n * Test script for the PWV Fund Application webhook\n * \n * This script simulates a Netlify form submission webhook with proper JWT signature\n */\n\n// Sample data from the logs\nconst sampleData = {\n number: 95,\n title: null,\n email: \"dt@example.com\",\n name: \"DT\",\n first_name: \"DT\",\n last_name: null,\n company: \"Test Company\",\n summary: \"This is a test message\",\n body: \"This is a test message\",\n data: {\n name: \"DT\",\n email: \"dt@example.com\",\n company: \"Test Company\",\n website: \"https://www.example.com\",\n deck: \"\",\n message: \"This is a test message\",\n ip: \"71.234.218.6\",\n user_agent: \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15\",\n referrer: \"https://pwv.com/apply/\"\n },\n created_at: \"2025-12-22T17:31:35.939Z\",\n human_fields: {\n Name: \"DT\",\n Email: \"dt@example.com\",\n \"Company Name\": \"Test Company\",\n Website: \"https://www.example.com\",\n \"Pitch Deck\": \"\",\n Message: \"This is a test message\"\n },\n ordered_human_fields: [\n { title: \"Name\", name: \"name\", value: \"DT\" },\n { title: \"Email\", name: \"email\", value: \"dt@example.com\" },\n { title: \"Company Name\", name: \"company\", value: \"Test Company\" },\n {\n title: \"Website\",\n name: \"website\",\n value: \"https://www.example.com\"\n },\n { title: \"Pitch Deck\", name: \"deck\", value: \"\" },\n {\n title: \"Message\",\n name: \"message\",\n value: \"This is a test message\"\n }\n ],\n id: \"69498077f82665c79f3c0775\",\n form_id: \"68dfcdf57cfcdb0008d62c8f\",\n site_url: \"https://pwv.com\",\n site_name: \"pwv-www\",\n form_name: \"apply\"\n};\n\n/**\n * Create a JWT signature for the webhook payload\n */\nasync function createWebhookSignature(body: string, secret: string): Promise {\n const hashedBody = createHash(\"sha256\").update(body).digest(\"hex\");\n \n const secretKey = new TextEncoder().encode(secret);\n \n const jwt = await new SignJWT({ sha256: hashedBody })\n .setProtectedHeader({ alg: \"HS256\" })\n .setIssuer(\"netlify\")\n .setIssuedAt()\n .sign(secretKey);\n \n return jwt;\n}\n\n/**\n * Test the webhook endpoint\n */\nasync function testWebhook() {\n const jwtSecret = Deno.env.get(\"NETLIFY_FORM_JWS\");\n \n if (!jwtSecret) {\n console.error(\"❌ Missing NETLIFY_FORM_JWS environment variable\");\n return;\n }\n \n // The webhook endpoint URL\n const webhookUrl = \"https://pwv--ef32c626b35a11f0a9a40224a6c84d84.web.val.run\";\n \n // Convert sample data to JSON string\n const body = JSON.stringify(sampleData);\n \n // Create the JWT signature\n const signature = await createWebhookSignature(body, jwtSecret);\n \n console.log(\"🧪 Testing webhook with sample data...\");\n console.log(\"📍 Endpoint:\", webhookUrl);\n console.log(\"📦 Payload ID:\", sampleData.id);\n console.log(\"👤 Test user:\", sampleData.data.name, `<${sampleData.data.email}>`);\n console.log(\"🏢 Company:\", sampleData.data.company);\n console.log(\"\");\n \n try {\n const response = await fetch(webhookUrl, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"x-netlify-event\": \"submission_created\",\n \"x-webhook-signature\": signature\n },\n body: body\n });\n \n const responseData = await response.json();\n \n console.log(\"📊 Response Status:\", response.status);\n console.log(\"📄 Response Body:\", responseData);\n \n if (response.ok) {\n console.log(\"✅ Webhook test successful!\");\n } else {\n console.log(\"❌ Webhook test failed!\");\n }\n } catch (error) {\n console.error(\"❌ Error testing webhook:\", error);\n }\n}\n\n// Run the test\nawait testWebhook();\n",["D",1766424817424],92,"versions",[297,299,300,301,302,303],{"_172":267,"_298":269},"previous",{"_172":269,"_298":274},{"_172":274,"_298":279},{"_172":279,"_298":284},{"_172":284,"_298":290},{"_172":290,"_298":-5},"versionNumber","page","hasNext","actionData","errors"]

pwv

pwv-fund-application

History for test-webhook.ts