fix: validate OpenNode webhook signature before processing

Author: Anshumancanrock

src/controllers/callbacks/opennode-callback-controller.ts

@@ -2,7 +2,10 @@ import { Request, Response } from 'express'
 
 import { Invoice, InvoiceStatus } from '../../@types/invoice'
 import { createLogger } from '../../factories/logger-factory'
+import { createSettings } from '../../factories/settings-factory'
 import { fromOpenNodeInvoice } from '../../utils/transform'
+import { getRemoteAddress } from '../../utils/http'
+import { hmacSha256 } from '../../utils/secret'
 import { IController } from '../../@types/controllers'
 import { IPaymentsService } from '../../@types/services'
 
@@ -13,14 +16,62 @@ export class OpenNodeCallbackController implements IController {
     private readonly paymentsService: IPaymentsService,
   ) {}
 
-  // TODO: Validate
   public async handleRequest(
     request: Request,
     response: Response,
   ) {
     debug('request headers: %o', request.headers)
     debug('request body: %O', request.body)
 
+    const settings = createSettings()
+    const remoteAddress = getRemoteAddress(request, settings)
+    const paymentProcessor = settings.payments?.processor
+
+    if (paymentProcessor !== 'opennode') {
+      debug('denied request from %s to /callbacks/opennode which is not the current payment processor', remoteAddress)
+      response
+        .status(403)
+        .send('Forbidden')
+      return
+    }
+
+    const validStatuses = ['expired', 'refunded', 'unpaid', 'processing', 'underpaid', 'paid']
+
+    if (
+      !request.body
+      || typeof request.body.id !== 'string'
+      || typeof request.body.hashed_order !== 'string'
+      || typeof request.body.status !== 'string'
+      || !validStatuses.includes(request.body.status)
+    ) {
+      response
+        .status(400)
+        .setHeader('content-type', 'text/plain; charset=utf8')
+        .send('Bad Request')
+      return
+    }
+
+    const openNodeApiKey = process.env.OPENNODE_API_KEY
+    if (!openNodeApiKey) {
+      debug('OPENNODE_API_KEY is not configured; unable to verify OpenNode callback from %s', remoteAddress)
+      response
+        .status(500)
+        .setHeader('content-type', 'text/plain; charset=utf8')
+        .send('Internal Server Error')
+      return
+    }
+
+    const expected = hmacSha256(openNodeApiKey, request.body.id).toString('hex')
+    const actual = request.body.hashed_order
+
+    if (expected !== actual) {
+      debug('unauthorized request from %s to /callbacks/opennode: hashed_order mismatch', remoteAddress)
+      response
+        .status(403)
+        .send('Forbidden')
+      return
+    }
+
     const invoice = fromOpenNodeInvoice(request.body)
 
     debug('invoice', invoice)