GeneratorsGo

Changelog

July 22, 2026

1.51.0

(feat): Add body-hash binding verification for HMAC webhooks that transmit a hash of the raw request body in the notification URL.

(feat): Add webhook signature verification support. When a webhook declares HMAC signature verification in the IR, the generated Go SDK now emits a WebhooksHelper with a VerifySignature method that validates the signature (and optional timestamp) using a new stdlib-only core utility (crypto/hmac/crypto/sha*/encoding with constant-time comparison).

(feat): Extend the generated VerifySignature webhook helper with Twilio-compatible verification, mirroring the TypeScript reference:

  • Multi-value form params: when payloadFormat.bodySort is set, the requestBody parameter accepts either a raw string or a map[string][]string-shaped multimap of POST body parameters; keys are sorted, each key’s values are deduped and sorted, and key + value pairs are concatenated with no separator before signing.
  • Runtime body-hash branch: when a bodyHashBinding is configured, the configured query parameter is read from the notification URL at runtime. When present (JSON) the raw body is hashed and constant-time compared and the signature is checked over the URL only; when absent (classic form) the signature is checked over the URL + params with no body-hash check. The body-hash check runs once above the candidate loop.
  • No-throw: the verifier fails closed. Every verification-path failure (null/empty inputs, a missing/malformed timestamp, a body-hash type mismatch) now returns false rather than an error.
  • URL any-match normalization: when notificationUrlNormalization is configured, the signature is verified against several normalized notification-URL candidates (standard-port/no-port variants and legacy query re-encoding), accepting on the first constant-time match. A stdlib-only NotificationUrlCandidates helper (using net/url) is added to the core webhook utility. Output is unchanged for webhooks that do not configure these fields, other than the no-throw behavior which applies to all generated helpers.