Spaces:
Running
Running
| ; | |
| var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) { | |
| var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d; | |
| if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc); | |
| else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r; | |
| return c > 3 && r && Object.defineProperty(target, key, r), r; | |
| }; | |
| var __metadata = (this && this.__metadata) || function (k, v) { | |
| if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v); | |
| }; | |
| var PaystackWebhookGuard_1; | |
| Object.defineProperty(exports, "__esModule", { value: true }); | |
| exports.PaystackWebhookGuard = void 0; | |
| const common_1 = require("@nestjs/common"); | |
| const config_1 = require("@nestjs/config"); | |
| const crypto_1 = require("crypto"); | |
| let PaystackWebhookGuard = PaystackWebhookGuard_1 = class PaystackWebhookGuard { | |
| configService; | |
| logger = new common_1.Logger(PaystackWebhookGuard_1.name); | |
| secretKey; | |
| isProduction; | |
| constructor(configService) { | |
| this.configService = configService; | |
| this.secretKey = this.configService.get("PAYSTACK_SECRET_KEY") || ""; | |
| this.isProduction = | |
| this.configService.get("NODE_ENV") === "production"; | |
| } | |
| canActivate(context) { | |
| if (!this.secretKey) { | |
| if (this.isProduction) { | |
| this.logger.error("PAYSTACK_SECRET_KEY is not configured in production — rejecting webhook."); | |
| throw new common_1.UnauthorizedException("Paystack is not configured"); | |
| } | |
| this.logger.warn("PAYSTACK_SECRET_KEY is not configured — webhook signature verification skipped (dev only)."); | |
| return true; | |
| } | |
| const request = context.switchToHttp().getRequest(); | |
| const signatureHeader = request.headers["x-paystack-signature"] || undefined; | |
| if (!signatureHeader) { | |
| throw new common_1.UnauthorizedException("Missing Paystack signature header"); | |
| } | |
| const rawBody = this.extractRawBody(request); | |
| if (!rawBody) { | |
| throw new common_1.UnauthorizedException("Unable to read raw request body"); | |
| } | |
| const expected = (0, crypto_1.createHmac)("sha512", this.secretKey) | |
| .update(rawBody) | |
| .digest("hex"); | |
| if (expected.length !== signatureHeader.length) { | |
| throw new common_1.UnauthorizedException("Invalid Paystack signature"); | |
| } | |
| let mismatch = 0; | |
| for (let i = 0; i < expected.length; i++) { | |
| mismatch |= expected.charCodeAt(i) ^ signatureHeader.charCodeAt(i); | |
| } | |
| if (mismatch !== 0) { | |
| throw new common_1.UnauthorizedException("Invalid Paystack signature"); | |
| } | |
| return true; | |
| } | |
| extractRawBody(request) { | |
| if (typeof request.rawBody === "string") | |
| return request.rawBody; | |
| if (Buffer.isBuffer(request.rawBody)) | |
| return request.rawBody.toString("utf8"); | |
| if (request.body && typeof request.body === "object") { | |
| try { | |
| return JSON.stringify(request.body); | |
| } | |
| catch { | |
| return undefined; | |
| } | |
| } | |
| return undefined; | |
| } | |
| }; | |
| exports.PaystackWebhookGuard = PaystackWebhookGuard; | |
| exports.PaystackWebhookGuard = PaystackWebhookGuard = PaystackWebhookGuard_1 = __decorate([ | |
| (0, common_1.Injectable)(), | |
| __metadata("design:paramtypes", [config_1.ConfigService]) | |
| ], PaystackWebhookGuard); | |
| //# sourceMappingURL=paystack-webhook.guard.js.map |