pook/compliancebot
1
0
Fork 0
Code Issues 1.1k Pull requests 82 Projects Releases Packages Wiki Activity Actions

[Agent] Issue #756: Add Zod webhook payload validation for Stripe events #759

Open
pook wants to merge 64 commits from agent-task/756 into main
pull from: agent-task/756
merge into: pook:main
Conversation 0 Commits 64 Files changed 68 +6696 -71
pook commented 2026-04-11 15:36:38 -04:00
Owner
Copy link

Summary

  • Adds packages/api/src/billing/webhook-schemas.ts with Zod schemas that validate Stripe webhook event envelopes and per-event data.object payloads
  • Covers four event types: checkout.session.completed, customer.subscription.updated, customer.subscription.deleted, invoice.payment_succeeded
  • Exports validateWebhookEvent function that returns fully typed data or throws WebhookValidationError with descriptive issue details
  • Adds zod as a dependency in the API package

Test plan

  • Call validateWebhookEvent with a valid checkout.session.completed payload and verify typed return
  • Call with missing id or wrong prefix and verify 400-style validation error
  • Call with unknown event type and verify it passes envelope validation without crashing
  • Integrate into billing.ts webhook route and confirm malformed payloads return 400
  • Run npx tsc --noEmit to confirm no type errors

🤖 Generated with Claude Code

## Summary - Adds `packages/api/src/billing/webhook-schemas.ts` with Zod schemas that validate Stripe webhook event envelopes and per-event `data.object` payloads - Covers four event types: `checkout.session.completed`, `customer.subscription.updated`, `customer.subscription.deleted`, `invoice.payment_succeeded` - Exports `validateWebhookEvent` function that returns fully typed data or throws `WebhookValidationError` with descriptive issue details - Adds `zod` as a dependency in the API package ## Test plan - [ ] Call `validateWebhookEvent` with a valid checkout.session.completed payload and verify typed return - [ ] Call with missing `id` or wrong prefix and verify 400-style validation error - [ ] Call with unknown event type and verify it passes envelope validation without crashing - [ ] Integrate into `billing.ts` webhook route and confirm malformed payloads return 400 - [ ] Run `npx tsc --noEmit` to confirm no type errors 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Add Zod webhook payload validation for Stripe events
Some checks are pending
CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Waiting to run
Details
f3a0cc4732 
Validates webhook payloads before processing to prevent crashes from
malformed data and injection attacks. Includes typed schemas for
checkout.session.completed, customer.subscription.updated,
customer.subscription.deleted, and invoice.payment_succeeded events.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
feat: issue #756 before-processing-stripe-webhook-events (agent task liancebot756)
Some checks failed
CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Has been cancelled
Details
921bcdfcc6
Some checks failed
CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Has been cancelled
Details
This pull request has changes conflicting with the target branch.
  • .forgejo/workflows/ci.yml
  • bun.lock
  • package.json
  • packages/api/package.json
  • packages/api/src/db/schema.ts
  • packages/api/src/index.ts
  • packages/api/src/middleware/csrf.ts
  • packages/api/src/middleware/rate-limit.ts
  • packages/api/src/middleware/security-headers.ts
  • packages/api/src/routes/admin.ts
  • packages/api/src/routes/billing.ts
  • packages/api/src/routes/generate-tos.ts
  • packages/api/src/routes/generate.ts
  • packages/api/src/routes/health.ts
  • packages/api/src/routes/questionnaire.ts
  • packages/api/src/services/document-generator.ts
  • packages/api/src/services/llm.ts
  • packages/api/src/templates/index.ts
  • packages/api/tsconfig.json
  • packages/shared/src/types.ts
  • packages/web/src/app/questionnaire/page.tsx
  • packages/web/src/components/documents/DocumentList.tsx
  • packages/web/src/components/questionnaire/ReviewStep.tsx
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin agent-task/756:agent-task/756
git switch agent-task/756
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent-task

Task for autonomous agent execution

  
agent-task

Paperclip autonomous agent task

No labels
agent-task
agent-task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pook/compliancebot!759
No description provided.