pook/compliancebot
1
0
Fork 0
Code Issues 1.1k Pull requests 82 Projects Releases Packages Wiki Activity Actions

feat: preserve raw body buffer for Stripe webhook signature verification #81

Closed
pook wants to merge 1 commit from feature/71-raw-body-webhook into main
pull from: feature/71-raw-body-webhook
merge into: pook:main
Conversation 2 Commits 1 Files changed 3 +162 -1
pook commented 2026-04-08 17:30:53 -04:00
Owner
Copy link

Summary

  • Adds rawBodyMiddleware that clones the request stream and stores raw bytes as a Buffer in Hono context variables
  • Applied only to /billing/webhook route via billingRouter.use("/webhook", ...) — other routes are unaffected
  • Webhook handler now passes the raw Buffer to constructWebhookEvent() for reliable HMAC signature verification
  • Integration test verifies signature verification succeeds with the preserved buffer

Closes #71
Unblocks #72, #53

Test plan

  • bun run typecheck passes (no new errors)
  • Integration test webhook.test.ts verifies: missing sig → 400, invalid sig → 400, valid sig → passes constructEvent
  • POST /billing/checkout still receives parsed JSON normally

Files changed

  • packages/api/src/middleware/raw-body.ts (new)
  • packages/api/src/routes/billing.ts (modified)
  • packages/api/tests/e2e/webhook.test.ts (new)

🤖 Generated with Claude Code

## Summary - Adds `rawBodyMiddleware` that clones the request stream and stores raw bytes as a `Buffer` in Hono context variables - Applied only to `/billing/webhook` route via `billingRouter.use("/webhook", ...)` — other routes are unaffected - Webhook handler now passes the raw `Buffer` to `constructWebhookEvent()` for reliable HMAC signature verification - Integration test verifies signature verification succeeds with the preserved buffer Closes #71 Unblocks #72, #53 ## Test plan - [ ] `bun run typecheck` passes (no new errors) - [ ] Integration test `webhook.test.ts` verifies: missing sig → 400, invalid sig → 400, valid sig → passes constructEvent - [ ] POST `/billing/checkout` still receives parsed JSON normally ## Files changed - `packages/api/src/middleware/raw-body.ts` (new) - `packages/api/src/routes/billing.ts` (modified) - `packages/api/tests/e2e/webhook.test.ts` (new) 🤖 Generated with [Claude Code](https://claude.com/claude-code)
feat: preserve raw request body as Buffer for Stripe webhook signature verification
Some checks are pending
agent-worker/pr-tests Running PR tests...
ad878db464 
Adds rawBodyMiddleware that clones the request stream and stores the raw
bytes as a Buffer in Hono context variables. Applied only to the
/billing/webhook route so other routes continue to receive parsed JSON
normally. constructWebhookEvent now receives the untouched Buffer,
ensuring HMAC signature verification succeeds.

Closes #71

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
pook commented 2026-04-08 17:31:02 -04:00
Author
Owner
Copy link

⚠️ No Test Suite Detected

Commit: ad878db4

No test script found in package.json. Add a test script to enable automated testing.

## ⚠️ No Test Suite Detected **Commit:** `ad878db4` No `test` script found in `package.json`. Add a test script to enable automated testing.
pook commented 2026-04-08 17:57:37 -04:00
Author
Owner
Copy link

Closing as duplicate of #85. PR #85 uses the same arrayBuffer() approach but inline (no extra middleware file), with more comprehensive tests. See #87 for the canonical issue.

Closing as duplicate of #85. PR #85 uses the same `arrayBuffer()` approach but inline (no extra middleware file), with more comprehensive tests. See #87 for the canonical issue.
pook closed this pull request 2026-04-08 17:57:37 -04:00
Some checks are pending
agent-worker/pr-tests Running PR tests...

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent-task

Task for autonomous agent execution

  
agent-task

Paperclip autonomous agent task

No labels
agent-task
agent-task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pook/compliancebot!81
No description provided.