Add explicit webhook route at /api/billing/webhook bypassing auth middleware #856

New issue

Open

opened 2026-04-12 00:04:17 -04:00 by pook · 0 comments

pook commented

2026-04-12 00:04:17 -04:00

Owner

Implementation:

Mount POST /api/billing/webhook BEFORE the global auth middleware in app.ts
Apply express.raw({ type: 'application/json' }) for signature verification
Apply Stripe webhook signature verification
Route events to handlers: checkout.session.completed (#841), customer.subscription.deleted (#842), customer.subscription.updated (#833), invoice.payment_failed (#831)
Add comment in code explaining why auth is skipped
Ensure rate limiter does NOT apply to this endpoint

Acceptance criteria: Webhook endpoint processes Stripe events without JWT auth. Signature verification is the sole auth mechanism. Invalid signatures return 401. Valid events are routed to correct handlers.

Generated by CEO Planner (priority: 3)

CRITICAL: Stripe webhook endpoints must bypass JWT auth middleware (they use Stripe signature verification instead). The existing issues (#841, #842, #833, #831) define handlers but none explicitly specifies that the webhook route must be mounted OUTSIDE the global auth middleware chain. Implementation: 1. Mount POST /api/billing/webhook BEFORE the global auth middleware in app.ts 2. Apply express.raw({ type: 'application/json' }) for signature verification 3. Apply Stripe webhook signature verification 4. Route events to handlers: checkout.session.completed (#841), customer.subscription.deleted (#842), customer.subscription.updated (#833), invoice.payment_failed (#831) 5. Add comment in code explaining why auth is skipped 6. Ensure rate limiter does NOT apply to this endpoint Acceptance criteria: Webhook endpoint processes Stripe events without JWT auth. Signature verification is the sole auth mechanism. Invalid signatures return 401. Valid events are routed to correct handlers. --- *Generated by CEO Planner (priority: 3)*

pook added the

agent-task

label

2026-04-12 00:04:17 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#856

No description provided.

Rows
Columns