[pedroalmeidaes]

Steps to test

• Go to the website project.
• Run env DOCS_BRANCH=this-pr-branch yarn docs to download the docs files from this PR.
• Run yarn start and go to /docs to check the changes.

[Copilot]

🟡 Changes recommended

Both guides contain unresolved replay-protection gaps and broken JavaScript examples.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds Webhooks 2.0 documentation for Select and Offer Marketplace, covering delivery handling, history, replaying, headers, and signature verification.

Changes:

• Documents retries, delivery metadata, idempotency, history, and replay workflows.
• Updates custom-header and signature-verification guidance.

File summaries

File	Summary	Findings
select/webhooks.md	Expands Select webhook lifecycle and verification documentation.	Critical: stale timestamps are not rejected, allowing replay. Moderate: crypto.createHmac lacks a required import.
oaas/webhooks.md	Expands Offer Marketplace webhook management and delivery documentation.	Critical: stale timestamps are not rejected, allowing replay. Moderate: crypto.createHmac lacks a required import.

Review details

Suppressed comments (4)

oaas/webhooks.md:126

• Because Buffer.from(undefined) throws, a request without x-fidel-signature makes this validator raise instead of returning false and allowing the handler to reject the request cleanly. Validate that the header is present and a string before constructing the buffer.

  const received = Buffer.from(fidelHeaders["x-fidel-signature"]);
  const expected = Buffer.from(signature);

oaas/webhooks.md:118

• This JavaScript example calls crypto.createHmac without importing or defining crypto; the browser crypto object and Node's global API do not provide this method, so the example fails when copied as shown. Add a Node crypto import (or otherwise identify the required setup).

function isSignatureValid(fidelHeaders, rawBody, secret, url) {
  function base64Digest(value) {
    return crypto.createHmac("sha256", secret).update(value).digest("base64");

select/webhooks.md:634

• Because Buffer.from(undefined) throws, a request without x-fidel-signature makes this validator raise instead of returning false and allowing the handler to reject the request cleanly. Validate that the header is present and a string before constructing the buffer.

  const received = Buffer.from(fidelHeaders["x-fidel-signature"]);
  const expected = Buffer.from(signature);

select/webhooks.md:627

• This JavaScript example calls crypto.createHmac without importing or defining crypto; the browser crypto object and Node's global API do not provide this method, so the example fails when copied as shown. Add a Node crypto import (or otherwise identify the required setup).

function isSignatureValid(fidelHeaders, rawBody, secret, url) {
  function base64Digest(s) {
    return crypto.createHmac("sha256", secret).update(s).digest("base64");

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.