Current behavior:
Webhooks sent without signature — merchants cannot verify authenticity.
Expected behavior:
Compute HMAC-SHA256 over JSON body using signingSecret. Include in X-BettaPay-Signature: t={unix_ts},s={hex_hmac}. Timestamp prevents replay attacks (merchant should reject >5min old). Skip signing if no secret configured.
Files to modify:
shared/webhook-delivery/index.ts — add HMAC signingservices/indexer/src/index.ts — include signingSecret in job data- Test:
shared/webhook-delivery/index.test.ts
Test requirements:
- With secret — signature header present, correctly formatted.
- Without secret — no signature header.
- Signature can be recomputed by consumer (same body + secret + timestamp = same HMAC).
Acceptance criteria:
- Webhooks signed with HMAC-SHA256 when secret configured.
- Backward compatible with existing unsigned webhooks.
Current behavior:
Webhooks sent without signature — merchants cannot verify authenticity.
Expected behavior:
Compute HMAC-SHA256 over JSON body using
signingSecret. Include inX-BettaPay-Signature: t={unix_ts},s={hex_hmac}. Timestamp prevents replay attacks (merchant should reject >5min old). Skip signing if no secret configured.Files to modify:
shared/webhook-delivery/index.ts— add HMAC signingservices/indexer/src/index.ts— includesigningSecretin job datashared/webhook-delivery/index.test.tsTest requirements:
Acceptance criteria: