The signing layer that refuses to guess.

import { FabricClient } from "@signing-fabric/sdk-server";

const fabric = new FabricClient({
  baseUrl: process.env.FABRIC_API_URL,
  apiKey: process.env.FABRIC_API_KEY,
});

// Cursor-following iterator over the append-only trail.
for await (const event of fabric.audit.iterate({
  action: "signing_request.approved",
  limit: 50,
})) {
  console.log(event.at, event.actor_id, event.outcome);
}

// Policies are versioned; a request is always evaluated
// against the version that was active when it was created.
const { data: policies } = await fabric.policies.list();

for (const policy of policies) {
  const { data: versions } = await fabric.policies.versions(policy.id);
  console.log(policy.name, versions.at(0)?.version);
}

import { verifyWebhookSignature } from "@signing-fabric/sdk-server";

app.post("/fabric", express.raw({ type: "*/*" }), (req, res) => {
  try {
    // The RAW body — re-serialized JSON will not verify.
    verifyWebhookSignature(
      req.body,
      req.header("X-SF-Signature") ?? "",
      process.env.FABRIC_WEBHOOK_SECRET,
    );
  } catch {
    return res.sendStatus(400);
  }

  res.sendStatus(202);
});