fix(server-sdk): report a missing sha256 claim in WebhookReceiver

.changeset/webhook-missing-sha256.md

@@ -0,0 +1,5 @@
+---
+'livekit-server-sdk': patch
+---
+
+`WebhookReceiver.receive` reports a token without a `sha256` claim as "sha256 was not found in the token" instead of "sha256 checksum of body does not match", as the Python server SDK does.

packages/livekit-server-sdk/src/WebhookReceiver.test.ts

@@ -24,6 +24,20 @@ describe('webhook receiver', () => {
     expect(event.room?.name).toBe('mytestroom');
     expect(event.event).toBe('room_started');
   });
+
+  it('rejects a body that does not match the token hash', async () => {
+    const token = await t.toJwt();
+    await expect(receiver.receive(`${body} `, token)).rejects.toThrow(
+      'sha256 checksum of body does not match',
+    );
+  });
+
+  it('reports a token without a sha256 claim as such', async () => {
+    const token = await new AccessToken(testApiKey, testSecret).toJwt();
+    await expect(receiver.receive(body, token)).rejects.toThrow(
+      'sha256 was not found in the token',
+    );
+  });
 });
 
 describe('decoding json payload', () => {

packages/livekit-server-sdk/src/WebhookReceiver.ts

@@ -69,6 +69,9 @@ export class WebhookReceiver {
         throw new Error('authorization header is empty');
       }
       const claims = await this.verifier.verify(authHeader, clockTolerance);
+      if (!claims.sha256) {
+        throw new Error('sha256 was not found in the token');
+      }
       // confirm sha
       const hash = await digest(body);
       const hashDecoded = btoa(