Docs / Language & functions

a9script authoring pack — crypto functions

The crypto functions, with their arguments and a line of real script each. Called by bare name; nothing is imported. A call marked pauses does real work outside the script: the run is saved, and continues on the next line with the result.

uuid() — pauses

A fresh identifier, version 4, from real randomness. The value is kept the moment it is drawn, so a run that is saved and continued answers the same id — which is what makes it safe as an idempotency key for a call you must not make twice.

Answers: The identifier as text, e.g. f81d4fae-7dec-4d0e-a765-00a0c91e6bf6.

const key = uuid();
log("idempotency key " + key);

randomHex(bytes?) — pauses

Random bytes, written as hexadecimal — for a one-off token or a nonce. Real randomness, kept the moment it is drawn, exactly like uuid().

• bytes (number, optional) — How many bytes, from 1 to 1024. Defaults to 16.

Answers: Lower-case hexadecimal — two characters per byte, so 32 characters by default.

const nonce = randomHex(8);
log("nonce " + nonce);

sha256(text) — pauses

The SHA-256 digest of a piece of text, read as UTF-8 — the same digest every other system computes for the same string.

• text (string) — The text to hash.

Answers: The digest as lower-case hexadecimal, 64 characters.

const digest = sha256(input.event.body.id);
log("digest " + digest);

hmacSha256(key, message) — pauses

Signs a message with a shared secret (HMAC-SHA-256) — the shape webhook signatures use, so this is how a script proves a payload came from it. To CHECK an incoming signature, configure the endpoint’s own signature check instead: it runs before the script and compares in constant time, which === in a script does not.

• key (string) — The shared secret, as text.
• message (string) — What to sign, read as UTF-8.

Answers: The signature as lower-case hexadecimal, 64 characters.

const signature = hmacSha256(input.settings.signingSecret, input.event.body.id);
log("signature " + signature);